Btrfs: Fix failure cleanups when allocating extent buffers fail

Signed-off-by: Chris Mason <chris.mason@oracle.com>

1 files changed, 30 insertions, 26 deletions

diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index b0677c84bb7..c976615dcda 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -2106,25 +2106,17 @@ static struct extent_buffer *__alloc_extent_buffer(struct extent_map_tree *tree,
 
         spin_lock(&tree->lru_lock);
         eb = find_lru(tree, start, len);
-        if (eb) {
-                goto lru_add;
-        }
         spin_unlock(&tree->lru_lock);
-
         if (eb) {
-                memset(eb, 0, sizeof(*eb));
-        } else {
-                eb = kmem_cache_zalloc(extent_buffer_cache, mask);
+                return eb;
         }
+
+        eb = kmem_cache_zalloc(extent_buffer_cache, mask);
         INIT_LIST_HEAD(&eb->lru);
         eb->start = start;
         eb->len = len;
         atomic_set(&eb->refs, 1);
 
-        spin_lock(&tree->lru_lock);
-lru_add:
-        add_lru(tree, eb);
-        spin_unlock(&tree->lru_lock);
         return eb;
 }
 
@@ -2151,7 +2143,7 @@ struct extent_buffer *alloc_extent_buffer(struct extent_map_tree *tree,
                 return NULL;
 
         if (eb->flags & EXTENT_BUFFER_FILLED)
-                return eb;
+                goto lru_add;
 
         if (page0) {
                 eb->first_page = page0;
@@ -2169,11 +2161,6 @@ struct extent_buffer *alloc_extent_buffer(struct extent_map_tree *tree,
                 p = find_or_create_page(mapping, index, mask | __GFP_HIGHMEM);
                 if (!p) {
                         WARN_ON(1);
-                        /* make sure the free only frees the pages we've
-                         * grabbed a reference on
-                         */
-                        eb->len = i << PAGE_CACHE_SHIFT;
-                        eb->start &= ~((u64)PAGE_CACHE_SIZE - 1);
                         goto fail;
                 }
                 set_page_extent_mapped(p);
@@ -2192,9 +2179,20 @@ struct extent_buffer *alloc_extent_buffer(struct extent_map_tree *tree,
         if (uptodate)
                 eb->flags |= EXTENT_UPTODATE;
         eb->flags |= EXTENT_BUFFER_FILLED;
+
+lru_add:
+        spin_lock(&tree->lru_lock);
+        add_lru(tree, eb);
+        spin_unlock(&tree->lru_lock);
         return eb;
+
 fail:
-        free_extent_buffer(eb);
+        if (!atomic_dec_and_test(&eb->refs))
+                return NULL;
+        for (index = 0; index < i; index++) {
+                page_cache_release(extent_buffer_page(eb, index));
+        }
+        __free_extent_buffer(eb);
         return NULL;
 }
 EXPORT_SYMBOL(alloc_extent_buffer);
@@ -2204,7 +2202,8 @@ struct extent_buffer *find_extent_buffer(struct extent_map_tree *tree,
                                           gfp_t mask)
 {
         unsigned long num_pages = num_extent_pages(start, len);
-        unsigned long i; unsigned long index = start >> PAGE_CACHE_SHIFT;
+        unsigned long i;
+        unsigned long index = start >> PAGE_CACHE_SHIFT;
         struct extent_buffer *eb;
         struct page *p;
         struct address_space *mapping = tree->mapping;
@@ -2215,16 +2214,11 @@ struct extent_buffer *find_extent_buffer(struct extent_map_tree *tree,
                 return NULL;
 
         if (eb->flags & EXTENT_BUFFER_FILLED)
-                return eb;
+                goto lru_add;
 
         for (i = 0; i < num_pages; i++, index++) {
                 p = find_lock_page(mapping, index);
                 if (!p) {
-                        /* make sure the free only frees the pages we've
-                         * grabbed a reference on
-                         */
-                        eb->len = i << PAGE_CACHE_SHIFT;
-                        eb->start &= ~((u64)PAGE_CACHE_SIZE - 1);
                         goto fail;
                 }
                 set_page_extent_mapped(p);
@@ -2245,9 +2239,19 @@ struct extent_buffer *find_extent_buffer(struct extent_map_tree *tree,
         if (uptodate)
                 eb->flags |= EXTENT_UPTODATE;
         eb->flags |= EXTENT_BUFFER_FILLED;
+
+lru_add:
+        spin_lock(&tree->lru_lock);
+        add_lru(tree, eb);
+        spin_unlock(&tree->lru_lock);
         return eb;
 fail:
-        free_extent_buffer(eb);
+        if (!atomic_dec_and_test(&eb->refs))
+                return NULL;
+        for (index = 0; index < i; index++) {
+                page_cache_release(extent_buffer_page(eb, index));
+        }
+        __free_extent_buffer(eb);
         return NULL;
 }
 EXPORT_SYMBOL(find_extent_buffer);