Btrfs: fix unprotected assignment of the target device

We didn't protect the assignment of the target device, it might cause the
problem that the super block update was skipped because we might find wrong
size of the target device during the assignment. Fix it by moving the
assignment sentences into the initialization function of the target device.
And there is another merit that we can check if the target device is suitable
more early.

Signed-off-by: Miao Xie <miaox@cn.fujitsu.com>
Signed-off-by: Chris Mason <clm@fb.com>

1 files changed, 8 insertions, 24 deletions

diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 10dfb41f4c22..72dc02e82945 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -330,29 +330,19 @@ int btrfs_dev_replace_start(struct btrfs_root *root,
                 return -EINVAL;
 
         mutex_lock(&fs_info->volume_mutex);
-        ret = btrfs_init_dev_replace_tgtdev(root, args->start.tgtdev_name,
-                                            &tgt_device);
-        if (ret) {
-                btrfs_err(fs_info, "target device %s is invalid!",
-                       args->start.tgtdev_name);
-                mutex_unlock(&fs_info->volume_mutex);
-                return -EINVAL;
-        }
-
         ret = btrfs_dev_replace_find_srcdev(root, args->start.srcdevid,
                                             args->start.srcdev_name,
                                             &src_device);
-        mutex_unlock(&fs_info->volume_mutex);
         if (ret) {
-                ret = -EINVAL;
-                goto leave_no_lock;
+                mutex_unlock(&fs_info->volume_mutex);
+                return ret;
         }
 
-        if (tgt_device->total_bytes < src_device->total_bytes) {
-                btrfs_err(fs_info, "target device is smaller than source device!");
-                ret = -EINVAL;
-                goto leave_no_lock;
-        }
+        ret = btrfs_init_dev_replace_tgtdev(root, args->start.tgtdev_name,
+                                            src_device, &tgt_device);
+        mutex_unlock(&fs_info->volume_mutex);
+        if (ret)
+                return ret;
 
         btrfs_dev_replace_lock(dev_replace);
         switch (dev_replace->replace_state) {
@@ -380,10 +370,6 @@ int btrfs_dev_replace_start(struct btrfs_root *root,
                       src_device->devid,
                       rcu_str_deref(tgt_device->name));
 
-        tgt_device->total_bytes = src_device->total_bytes;
-        tgt_device->disk_total_bytes = src_device->disk_total_bytes;
-        tgt_device->bytes_used = src_device->bytes_used;
-
         /*
          * from now on, the writes to the srcdev are all duplicated to
          * go to the tgtdev as well (refer to btrfs_map_block()).
@@ -426,9 +412,7 @@ leave:
         dev_replace->srcdev = NULL;
         dev_replace->tgtdev = NULL;
         btrfs_dev_replace_unlock(dev_replace);
-leave_no_lock:
-        if (tgt_device)
-                btrfs_destroy_dev_replace_tgtdev(fs_info, tgt_device);
+        btrfs_destroy_dev_replace_tgtdev(fs_info, tgt_device);
         return ret;
 }