Merge branch 'next' into for-linus

1 files changed, 61 insertions, 31 deletions

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 054744ac5719..c50271ad3157 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -338,6 +338,12 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
                 }
                 dst_copy = kmalloc(item_size, GFP_NOFS);
                 src_copy = kmalloc(item_size, GFP_NOFS);
+                if (!dst_copy || !src_copy) {
+                        btrfs_release_path(root, path);
+                        kfree(dst_copy);
+                        kfree(src_copy);
+                        return -ENOMEM;
+                }
 
                 read_extent_buffer(eb, src_copy, src_ptr, item_size);
 
@@ -665,6 +671,9 @@ static noinline int drop_one_dir_item(struct btrfs_trans_handle *trans,
         btrfs_dir_item_key_to_cpu(leaf, di, &location);
         name_len = btrfs_dir_name_len(leaf, di);
         name = kmalloc(name_len, GFP_NOFS);
+        if (!name)
+                return -ENOMEM;
+
         read_extent_buffer(leaf, name, (unsigned long)(di + 1), name_len);
         btrfs_release_path(root, path);
 
@@ -744,6 +753,9 @@ static noinline int backref_in_log(struct btrfs_root *log,
         int match = 0;
 
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
         ret = btrfs_search_slot(NULL, log, key, path, 0, 0);
         if (ret != 0)
                 goto out;
@@ -787,12 +799,12 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
         struct inode *dir;
         int ret;
         struct btrfs_inode_ref *ref;
-        struct btrfs_dir_item *di;
         struct inode *inode;
         char *name;
         int namelen;
         unsigned long ref_ptr;
         unsigned long ref_end;
+        int search_done = 0;
 
         /*
          * it is possible that we didn't log all the parent directories
@@ -833,7 +845,10 @@ again:
          * existing back reference, and we don't want to create
          * dangling pointers in the directory.
          */
-conflict_again:
+
+        if (search_done)
+                goto insert;
+
         ret = btrfs_search_slot(NULL, root, key, path, 0, 0);
         if (ret == 0) {
                 char *victim_name;
@@ -874,37 +889,21 @@ conflict_again:
                                 ret = btrfs_unlink_inode(trans, root, dir,
                                                          inode, victim_name,
                                                          victim_name_len);
-                                kfree(victim_name);
-                                btrfs_release_path(root, path);
-                                goto conflict_again;
                         }
                         kfree(victim_name);
                         ptr = (unsigned long)(victim_ref + 1) + victim_name_len;
                 }
                 BUG_ON(ret);
-        }
-        btrfs_release_path(root, path);
 
-        /* look for a conflicting sequence number */
-        di = btrfs_lookup_dir_index_item(trans, root, path, dir->i_ino,
-                                         btrfs_inode_ref_index(eb, ref),
-                                         name, namelen, 0);
-        if (di && !IS_ERR(di)) {
-                ret = drop_one_dir_item(trans, root, path, dir, di);
-                BUG_ON(ret);
-        }
-        btrfs_release_path(root, path);
-
-
-        /* look for a conflicting name */
-        di = btrfs_lookup_dir_item(trans, root, path, dir->i_ino,
-                                   name, namelen, 0);
-        if (di && !IS_ERR(di)) {
-                ret = drop_one_dir_item(trans, root, path, dir, di);
-                BUG_ON(ret);
+                /*
+                 * NOTE: we have searched root tree and checked the
+                 * coresponding ref, it does not need to check again.
+                 */
+                search_done = 1;
         }
         btrfs_release_path(root, path);
 
+insert:
         /* insert our name */
         ret = btrfs_add_link(trans, dir, inode, name, namelen, 0,
                              btrfs_inode_ref_index(eb, ref));
@@ -967,6 +966,8 @@ static noinline int fixup_inode_link_count(struct btrfs_trans_handle *trans,
         key.offset = (u64)-1;
 
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
 
         while (1) {
                 ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
@@ -1178,6 +1179,9 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans,
 
         name_len = btrfs_dir_name_len(eb, di);
         name = kmalloc(name_len, GFP_NOFS);
+        if (!name)
+                return -ENOMEM;
+
         log_type = btrfs_dir_type(eb, di);
         read_extent_buffer(eb, name, (unsigned long)(di + 1),
                    name_len);
@@ -1269,6 +1273,8 @@ static noinline int replay_one_dir_item(struct btrfs_trans_handle *trans,
         ptr_end = ptr + item_size;
         while (ptr < ptr_end) {
                 di = (struct btrfs_dir_item *)ptr;
+                if (verify_dir_item(root, eb, di))
+                        return -EIO;
                 name_len = btrfs_dir_name_len(eb, di);
                 ret = replay_one_name(trans, root, path, eb, di, key);
                 BUG_ON(ret);
@@ -1395,6 +1401,11 @@ again:
         ptr_end = ptr + item_size;
         while (ptr < ptr_end) {
                 di = (struct btrfs_dir_item *)ptr;
+                if (verify_dir_item(root, eb, di)) {
+                        ret = -EIO;
+                        goto out;
+                }
+
                 name_len = btrfs_dir_name_len(eb, di);
                 name = kmalloc(name_len, GFP_NOFS);
                 if (!name) {
@@ -1692,6 +1703,8 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans,
                 root_owner = btrfs_header_owner(parent);
 
                 next = btrfs_find_create_tree_block(root, bytenr, blocksize);
+                if (!next)
+                        return -ENOMEM;
 
                 if (*level == 1) {
                         wc->process_func(root, next, wc, ptr_gen);
@@ -1802,7 +1815,8 @@ static int walk_log_tree(struct btrfs_trans_handle *trans,
         int orig_level;
 
         path = btrfs_alloc_path();
-        BUG_ON(!path);
+        if (!path)
+                return -ENOMEM;
 
         level = btrfs_header_level(log->node);
         orig_level = level;
@@ -2032,6 +2046,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
                 wait_log_commit(trans, log_root_tree,
                                 log_root_tree->log_transid);
                 mutex_unlock(&log_root_tree->log_mutex);
+                ret = 0;
                 goto out;
         }
         atomic_set(&log_root_tree->log_commit[index2], 1);
@@ -2096,7 +2111,7 @@ out:
         smp_mb();
         if (waitqueue_active(&root->log_commit_wait[index1]))
                 wake_up(&root->log_commit_wait[index1]);
-        return 0;
+        return ret;
 }
 
 static void free_log_tree(struct btrfs_trans_handle *trans,
@@ -2194,6 +2209,9 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
 
         log = root->log_root;
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
         di = btrfs_lookup_dir_item(trans, log, path, dir->i_ino,
                                    name, name_len, -1);
         if (IS_ERR(di)) {
@@ -2594,6 +2612,9 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
 
         ins_data = kmalloc(nr * sizeof(struct btrfs_key) +
                            nr * sizeof(u32), GFP_NOFS);
+        if (!ins_data)
+                return -ENOMEM;
+
         ins_sizes = (u32 *)ins_data;
         ins_keys = (struct btrfs_key *)(ins_data + nr * sizeof(u32));
 
@@ -2725,7 +2746,13 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
         log = root->log_root;
 
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
         dst_path = btrfs_alloc_path();
+        if (!dst_path) {
+                btrfs_free_path(path);
+                return -ENOMEM;
+        }
 
         min_key.objectid = inode->i_ino;
         min_key.type = BTRFS_INODE_ITEM_KEY;
@@ -3075,16 +3102,20 @@ int btrfs_recover_log_trees(struct btrfs_root *log_root_tree)
                 .stage = 0,
         };
 
-        fs_info->log_root_recovering = 1;
         path = btrfs_alloc_path();
-        BUG_ON(!path);
+        if (!path)
+                return -ENOMEM;
+
+        fs_info->log_root_recovering = 1;
 
         trans = btrfs_start_transaction(fs_info->tree_root, 0);
+        BUG_ON(IS_ERR(trans));
 
         wc.trans = trans;
         wc.pin = 1;
 
-        walk_log_tree(trans, log_root_tree, &wc);
+        ret = walk_log_tree(trans, log_root_tree, &wc);
+        BUG_ON(ret);
 
 again:
         key.objectid = BTRFS_TREE_LOG_OBJECTID;
@@ -3108,8 +3139,7 @@ again:
 
                 log = btrfs_read_fs_root_no_radix(log_root_tree,
                                                   &found_key);
-                BUG_ON(!log);
-
+                BUG_ON(IS_ERR(log));
 
                 tmp_key.objectid = found_key.offset;
                 tmp_key.type = BTRFS_ROOT_ITEM_KEY;