Btrfs: delete checksum items before marking blocks free

Btrfs maintains a cache of blocks available for allocation in ram.  The
code that frees extents was marking the extents free and then deleting
the checksum items.

This meant it was possible the extent would be reallocated before the
checksum item was actually deleted, leading to races and other
problems as the checksums were updated for the newly allocated extent.

The fix is to delete the checksum before marking the extent free.

Signed-off-by: Chris Mason <chris.mason@oracle.com>

2 files changed, 7 insertions, 3 deletions

diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index fbd6a8f28b52..9ef2a2be2686 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2477,15 +2477,15 @@ static int __free_extent(struct btrfs_trans_handle *trans,
                                       num_to_del);
                 BUG_ON(ret);
                 btrfs_release_path(extent_root, path);
-                ret = update_block_group(trans, root, bytenr, num_bytes, 0,
-                                         mark_free);
-                BUG_ON(ret);
 
                 if (owner_objectid >= BTRFS_FIRST_FREE_OBJECTID) {
                         ret = btrfs_del_csums(trans, root, bytenr, num_bytes);
                         BUG_ON(ret);
                 }
 
+                ret = update_block_group(trans, root, bytenr, num_bytes, 0,
+                                         mark_free);
+                BUG_ON(ret);
 #ifdef BIO_RW_DISCARD
                 /* Tell the block device(s) that the sectors can be discarded */
                 ret = btrfs_map_block(&root->fs_info->mapping_tree, READ,
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
index df0447632dbd..7acadf3b742a 100644
--- a/fs/btrfs/file-item.c
+++ b/fs/btrfs/file-item.c
@@ -537,6 +537,8 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
                 if (key.offset >= bytenr && csum_end <= end_byte) {
                         ret = btrfs_del_item(trans, root, path);
                         BUG_ON(ret);
+                        if (key.offset == bytenr)
+                                break;
                 } else if (key.offset < bytenr && csum_end > end_byte) {
                         unsigned long offset;
                         unsigned long shift_len;
@@ -583,6 +585,8 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
                         ret = truncate_one_csum(trans, root, path,
                                                 &key, bytenr, len);
                         BUG_ON(ret);
+                        if (key.offset < bytenr)
+                                break;
                 }
                 btrfs_release_path(root, path);
         }