Merge tag 'for-4.18-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull btrfs fixes from David Sterba:
 "Three regression fixes. They're few-liners and fixing some corner
  cases missed in the origial patches"

* tag 'for-4.18-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: scrub: Don't use inode page cache in scrub_handle_errored_block()
  btrfs: fix use-after-free of cmp workspace pages
  btrfs: restore uuid_mutex in btrfs_open_devices

3 files changed, 13 insertions, 8 deletions

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 43ecbe620dea..b077544b5232 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3327,11 +3327,13 @@ static void btrfs_cmp_data_free(struct cmp_pages *cmp)
                 if (pg) {
                         unlock_page(pg);
                         put_page(pg);
+                        cmp->src_pages[i] = NULL;
                 }
                 pg = cmp->dst_pages[i];
                 if (pg) {
                         unlock_page(pg);
                         put_page(pg);
+                        cmp->dst_pages[i] = NULL;
                 }
         }
 }
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 572306036477..6702896cdb8f 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -1151,11 +1151,6 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check)
                 return ret;
         }
 
-        if (sctx->is_dev_replace && !is_metadata && !have_csum) {
-                sblocks_for_recheck = NULL;
-                goto nodatasum_case;
-        }
-
         /*
          * read all mirrors one after the other. This includes to
          * re-read the extent or metadata block that failed (that was
@@ -1268,13 +1263,19 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check)
                 goto out;
         }
 
-        if (!is_metadata && !have_csum) {
+        /*
+         * NOTE: Even for nodatasum case, it's still possible that it's a
+         * compressed data extent, thus scrub_fixup_nodatasum(), which write
+         * inode page cache onto disk, could cause serious data corruption.
+         *
+         * So here we could only read from disk, and hope our recovery could
+         * reach disk before the newer write.
+         */
+        if (0 && !is_metadata && !have_csum) {
                 struct scrub_fixup_nodatasum *fixup_nodatasum;
 
                 WARN_ON(sctx->is_dev_replace);
 
-nodatasum_case:
-
                 /*
                  * !is_metadata and !have_csum, this means that the data
                  * might not be COWed, that it might be modified
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index e034ad9e23b4..1da162928d1a 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1146,6 +1146,7 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
 {
         int ret;
 
+        mutex_lock(&uuid_mutex);
         mutex_lock(&fs_devices->device_list_mutex);
         if (fs_devices->opened) {
                 fs_devices->opened++;
@@ -1155,6 +1156,7 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                 ret = open_fs_devices(fs_devices, flags, holder);
         }
         mutex_unlock(&fs_devices->device_list_mutex);
+        mutex_unlock(&uuid_mutex);
 
         return ret;
 }