Btrfs: Fix extent replacment race

Data COW means that whenever we write to a file, we replace any old
extent pointers with new ones.  There was a window where a readpage
might find the old extent pointers on disk and cache them in the
extent_map tree in ram in the middle of a given write replacing them.

Even though both the readpage and the write had their respective bytes
in the file locked, the extent readpage inserts may cover more bytes than
it had locked down.

This commit closes the race by keeping the new extent pinned in the extent
map tree until after the on-disk btree is properly setup with the new
extent pointers.

Signed-off-by: Chris Mason <chris.mason@oracle.com>

1 files changed, 2 insertions, 3 deletions

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 9f4db848db10..e2d8e90259b0 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -597,9 +597,8 @@ again:
                 clear_page_dirty_for_io(page);
 
                 btrfs_set_extent_delalloc(inode, page_start, page_end);
-
-                unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
                 set_page_dirty(page);
+                unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
                 unlock_page(page);
                 page_cache_release(page);
                 balance_dirty_pages_ratelimited_nr(inode->i_mapping, 1);
@@ -977,7 +976,7 @@ static long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
 
         /* punch hole in destination first */
         btrfs_drop_extents(trans, root, inode, off, off + len,
-                           off + len, 0, &hint_byte);
+                           off + len, 0, &hint_byte, 1);
 
         /* clone data */
         key.objectid = src->i_ino;