btrfs: fix crash when tracepoint arguments are freed by wq callbacks

commit ac0c7cf8be00f269f82964cf7b144ca3edc5dbc4 upstream.

Enabling btrfs tracepoints leads to instant crash, as reported. The wq
callbacks could free the memory and the tracepoints started to
dereference the members to get to fs_info.

The proposed fix https://marc.info/?l=linux-btrfs&m=148172436722606&w=2
removed the tracepoints but we could preserve them by passing only the
required data in a safe way.

Fixes: bc074524e123 ("btrfs: prefix fsid to all trace events")
Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 13 insertions, 9 deletions

diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
index e030d6f6c19a..6d7fe1169956 100644
--- a/include/trace/events/btrfs.h
+++ b/include/trace/events/btrfs.h
@@ -1162,22 +1162,26 @@ DECLARE_EVENT_CLASS(btrfs__work,
                    __entry->func, __entry->ordered_func, __entry->ordered_free)
 );
 
-/* For situiations that the work is freed */
+/*
+ * For situiations when the work is freed, we pass fs_info and a tag that that
+ * matches address of the work structure so it can be paired with the
+ * scheduling event.
+ */
 DECLARE_EVENT_CLASS(btrfs__work__done,
 
-        TP_PROTO(struct btrfs_work *work),
+        TP_PROTO(struct btrfs_fs_info *fs_info, void *wtag),
 
-        TP_ARGS(work),
+        TP_ARGS(fs_info, wtag),
 
         TP_STRUCT__entry_btrfs(
-                __field(        void *, work                    )
+                __field(        void *, wtag                    )
         ),
 
-        TP_fast_assign_btrfs(btrfs_work_owner(work),
-                __entry->work           = work;
+        TP_fast_assign_btrfs(fs_info,
+                __entry->wtag           = wtag;
         ),
 
-        TP_printk_btrfs("work->%p", __entry->work)
+        TP_printk_btrfs("work->%p", __entry->wtag)
 );
 
 DEFINE_EVENT(btrfs__work, btrfs_work_queued,
@@ -1196,9 +1200,9 @@ DEFINE_EVENT(btrfs__work, btrfs_work_sched,
 
 DEFINE_EVENT(btrfs__work__done, btrfs_all_work_done,
 
-        TP_PROTO(struct btrfs_work *work),
+        TP_PROTO(struct btrfs_fs_info *fs_info, void *wtag),
 
-        TP_ARGS(work)
+        TP_ARGS(fs_info, wtag)
 );
 
 DEFINE_EVENT(btrfs__work, btrfs_ordered_sched,