Btrfs: fix btrfs fallocate oops and deadlock

Btrfs fallocate was incorrectly starting a transaction with a lock held
on the extent_io tree for the file, which could deadlock.  Strictly
speaking it was using join_transaction which would be safe, but it is better
to move the transaction outside of the lock.

When preallocated extents are overwritten, btrfs_mark_buffer_dirty was
being called on an unlocked buffer.  This was triggering an assertion and
oops because the lock is supposed to be held.

The bug was calling btrfs_mark_buffer_dirty on a leaf after btrfs_del_item had
been run.  btrfs_del_item takes care of dirtying things, so the solution is a
to skip the btrfs_mark_buffer_dirty call in this case.

Signed-off-by: Chris Mason <chris.mason@oracle.com>

1 files changed, 3 insertions, 1 deletions

diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index e21c0060ee73..482f8db2cfd0 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -830,7 +830,7 @@ again:
 
                 ret = btrfs_del_items(trans, root, path, del_slot, del_nr);
                 BUG_ON(ret);
-                goto done;
+                goto release;
         } else if (split == start) {
                 if (locked_end < extent_end) {
                         ret = try_lock_extent(&BTRFS_I(inode)->io_tree,
@@ -926,6 +926,8 @@ again:
         }
 done:
         btrfs_mark_buffer_dirty(leaf);
+
+release:
         btrfs_release_path(root, path);
         if (split_end && split == start) {
                 split = end;