Btrfs: fix use-after-free problem of the device during device replace

The problem is:
	Task0(device scan task)		Task1(device replace task)
	scan_one_device()
	mutex_lock(&uuid_mutex)
	device = find_device()
					mutex_lock(&device_list_mutex)
					lock_chunk()
					rm_and_free_source_device
					unlock_chunk()
					mutex_unlock(&device_list_mutex)
	check device

Destroying the target device if device replace fails also has the same problem.

We fix this problem by locking uuid_mutex during destroying source device or
target device, just like the device remove operation.

It is a temporary solution, we can fix this problem and make the code more
clear by atomic counter in the future.

Signed-off-by: Miao Xie <miaox@cn.fujitsu.com>
Signed-off-by: Chris Mason <clm@fb.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index aa4c82863c73..e9cbbdb72978 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -509,6 +509,7 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
         ret = btrfs_commit_transaction(trans, root);
         WARN_ON(ret);
 
+        mutex_lock(&uuid_mutex);
         /* keep away write_all_supers() during the finishing procedure */
         mutex_lock(&root->fs_info->fs_devices->device_list_mutex);
         mutex_lock(&root->fs_info->chunk_mutex);
@@ -536,6 +537,7 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
                 btrfs_dev_replace_unlock(dev_replace);
                 mutex_unlock(&root->fs_info->chunk_mutex);
                 mutex_unlock(&root->fs_info->fs_devices->device_list_mutex);
+                mutex_unlock(&uuid_mutex);
                 if (tgt_device)
                         btrfs_destroy_dev_replace_tgtdev(fs_info, tgt_device);
                 mutex_unlock(&dev_replace->lock_finishing_cancel_unmount);
@@ -591,6 +593,7 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
          */
         mutex_unlock(&root->fs_info->chunk_mutex);
         mutex_unlock(&root->fs_info->fs_devices->device_list_mutex);
+        mutex_unlock(&uuid_mutex);
 
         /* write back the superblocks */
         trans = btrfs_start_transaction(root, 0);