Btrfs: corruption hunt continues

Signed-off-by: Chris Mason <chris.mason@oracle.com>

11 files changed, 187 insertions, 105 deletions

diff --git a/fs/btrfs/bit-radix.c b/fs/btrfs/bit-radix.c
index 43807cc3cce7..845422368f48 100644
--- a/fs/btrfs/bit-radix.c
+++ b/fs/btrfs/bit-radix.c
@@ -16,12 +16,14 @@ int set_radix_bit(struct radix_tree_root *radix, unsigned long bit)
 
         bits = radix_tree_lookup(radix, slot);
         if (!bits) {
-                bits = kmalloc(BIT_ARRAY_BYTES, GFP_NOIO);
+                bits = kmalloc(BIT_ARRAY_BYTES, GFP_NOFS);
                 if (!bits)
                         return -ENOMEM;
                 memset(bits + 1, 0, BIT_ARRAY_BYTES - sizeof(unsigned long));
                 bits[0] = slot;
+                radix_tree_preload(GFP_NOFS);
                 ret = radix_tree_insert(radix, slot, bits);
+                radix_tree_preload_end();
                 if (ret)
                         return ret;
         }
@@ -59,7 +61,7 @@ int clear_radix_bit(struct radix_tree_root *radix, unsigned long bit)
         if (!bits)
                 return 0;
         clear_bit(bit_slot, bits + 1);
-
+#if 0
         for (i = 1; i < BIT_ARRAY_BYTES / sizeof(unsigned long); i++) {
                 if (bits[i]) {
                         empty = 0;
@@ -69,8 +71,11 @@ int clear_radix_bit(struct radix_tree_root *radix, unsigned long bit)
 
         if (empty) {
                 bits = radix_tree_delete(radix, slot);
+                synchronize_rcu();
                 BUG_ON(!bits);
+                kfree(bits);
         }
+#endif
         return 0;
 }
 
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index b7f3fcb72c62..a0dfa2d6cb9b 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -51,7 +51,7 @@ static int btrfs_cow_block(struct btrfs_trans_handle *trans, struct btrfs_root
         btrfs_set_header_blocknr(&cow_node->header, cow->b_blocknr);
         btrfs_set_header_generation(&cow_node->header, trans->transid);
         *cow_ret = cow;
-        mark_buffer_dirty(cow);
+        btrfs_mark_buffer_dirty(cow);
         btrfs_inc_ref(trans, root, buf);
         if (buf == root->node) {
                 root->node = cow;
@@ -62,7 +62,7 @@ static int btrfs_cow_block(struct btrfs_trans_handle *trans, struct btrfs_root
         } else {
                 btrfs_set_node_blockptr(btrfs_buffer_node(parent), parent_slot,
                                         cow->b_blocknr);
-                mark_buffer_dirty(parent);
+                btrfs_mark_buffer_dirty(parent);
                 btrfs_free_extent(trans, root, buf->b_blocknr, 1, 1);
         }
         btrfs_block_release(root, buf);
@@ -312,11 +312,12 @@ static int balance_level(struct btrfs_trans_handle *trans, struct btrfs_root
                 BUG_ON(!child);
                 root->node = child;
                 path->nodes[level] = NULL;
+                clean_tree_block(trans, root, mid_buf);
+                wait_on_buffer(mid_buf);
                 /* once for the path */
                 btrfs_block_release(root, mid_buf);
                 /* once for the root ptr */
                 btrfs_block_release(root, mid_buf);
-                clean_tree_block(trans, root, mid_buf);
                 return btrfs_free_extent(trans, root, blocknr, 1, 1);
         }
         parent = btrfs_buffer_node(parent_buf);
@@ -351,8 +352,9 @@ static int balance_level(struct btrfs_trans_handle *trans, struct btrfs_root
                         ret = wret;
                 if (btrfs_header_nritems(&right->header) == 0) {
                         u64 blocknr = right_buf->b_blocknr;
-                        btrfs_block_release(root, right_buf);
                         clean_tree_block(trans, root, right_buf);
+                        wait_on_buffer(right_buf);
+                        btrfs_block_release(root, right_buf);
                         right_buf = NULL;
                         right = NULL;
                         wret = del_ptr(trans, root, path, level + 1, pslot +
@@ -363,10 +365,11 @@ static int balance_level(struct btrfs_trans_handle *trans, struct btrfs_root
                         if (wret)
                                 ret = wret;
                 } else {
-                        memcpy(&parent->ptrs[pslot + 1].key,
-                                &right->ptrs[0].key,
-                                sizeof(struct btrfs_disk_key));
-                        mark_buffer_dirty(parent_buf);
+                        btrfs_memcpy(root, parent,
+                                     &parent->ptrs[pslot + 1].key,
+                                     &right->ptrs[0].key,
+                                     sizeof(struct btrfs_disk_key));
+                        btrfs_mark_buffer_dirty(parent_buf);
                 }
         }
         if (btrfs_header_nritems(&mid->header) == 1) {
@@ -388,8 +391,9 @@ static int balance_level(struct btrfs_trans_handle *trans, struct btrfs_root
         if (btrfs_header_nritems(&mid->header) == 0) {
                 /* we've managed to empty the middle node, drop it */
                 u64 blocknr = mid_buf->b_blocknr;
-                btrfs_block_release(root, mid_buf);
                 clean_tree_block(trans, root, mid_buf);
+                wait_on_buffer(mid_buf);
+                btrfs_block_release(root, mid_buf);
                 mid_buf = NULL;
                 mid = NULL;
                 wret = del_ptr(trans, root, path, level + 1, pslot);
@@ -400,9 +404,10 @@ static int balance_level(struct btrfs_trans_handle *trans, struct btrfs_root
                         ret = wret;
         } else {
                 /* update the parent key to reflect our changes */
-                memcpy(&parent->ptrs[pslot].key, &mid->ptrs[0].key,
-                       sizeof(struct btrfs_disk_key));
-                mark_buffer_dirty(parent_buf);
+                btrfs_memcpy(root, parent,
+                             &parent->ptrs[pslot].key, &mid->ptrs[0].key,
+                             sizeof(struct btrfs_disk_key));
+                btrfs_mark_buffer_dirty(parent_buf);
         }
 
         /* update the path */
@@ -544,8 +549,8 @@ static int fixup_low_keys(struct btrfs_trans_handle *trans, struct btrfs_root
                 if (!path->nodes[i])
                         break;
                 t = btrfs_buffer_node(path->nodes[i]);
-                memcpy(&t->ptrs[tslot].key, key, sizeof(*key));
-                mark_buffer_dirty(path->nodes[i]);
+                btrfs_memcpy(root, t, &t->ptrs[tslot].key, key, sizeof(*key));
+                btrfs_mark_buffer_dirty(path->nodes[i]);
                 if (tslot != 0)
                         break;
         }
@@ -580,17 +585,17 @@ static int push_node_left(struct btrfs_trans_handle *trans, struct btrfs_root
         if (src_nritems < push_items)
                 push_items = src_nritems;
 
-        memcpy(dst->ptrs + dst_nritems, src->ptrs,
-                push_items * sizeof(struct btrfs_key_ptr));
+        btrfs_memcpy(root, dst, dst->ptrs + dst_nritems, src->ptrs,
+                     push_items * sizeof(struct btrfs_key_ptr));
         if (push_items < src_nritems) {
-                memmove(src->ptrs, src->ptrs + push_items,
+                btrfs_memmove(root, src, src->ptrs, src->ptrs + push_items,
                         (src_nritems - push_items) *
                         sizeof(struct btrfs_key_ptr));
         }
         btrfs_set_header_nritems(&src->header, src_nritems - push_items);
         btrfs_set_header_nritems(&dst->header, dst_nritems + push_items);
-        mark_buffer_dirty(src_buf);
-        mark_buffer_dirty(dst_buf);
+        btrfs_mark_buffer_dirty(src_buf);
+        btrfs_mark_buffer_dirty(dst_buf);
         return ret;
 }
 
@@ -629,16 +634,18 @@ static int balance_node_right(struct btrfs_trans_handle *trans, struct
         if (max_push < push_items)
                 push_items = max_push;
 
-        memmove(dst->ptrs + push_items, dst->ptrs,
-                dst_nritems * sizeof(struct btrfs_key_ptr));
-        memcpy(dst->ptrs, src->ptrs + src_nritems - push_items,
-                push_items * sizeof(struct btrfs_key_ptr));
+        btrfs_memmove(root, dst, dst->ptrs + push_items, dst->ptrs,
+                      dst_nritems * sizeof(struct btrfs_key_ptr));
+
+        btrfs_memcpy(root, dst, dst->ptrs,
+                     src->ptrs + src_nritems - push_items,
+                     push_items * sizeof(struct btrfs_key_ptr));
 
         btrfs_set_header_nritems(&src->header, src_nritems - push_items);
         btrfs_set_header_nritems(&dst->header, dst_nritems + push_items);
 
-        mark_buffer_dirty(src_buf);
-        mark_buffer_dirty(dst_buf);
+        btrfs_mark_buffer_dirty(src_buf);
+        btrfs_mark_buffer_dirty(dst_buf);
         return ret;
 }
 
@@ -674,10 +681,11 @@ static int insert_new_root(struct btrfs_trans_handle *trans, struct btrfs_root
                 lower_key = &((struct btrfs_leaf *)lower)->items[0].key;
         else
                 lower_key = &lower->ptrs[0].key;
-        memcpy(&c->ptrs[0].key, lower_key, sizeof(struct btrfs_disk_key));
+        btrfs_memcpy(root, c, &c->ptrs[0].key, lower_key,
+                     sizeof(struct btrfs_disk_key));
         btrfs_set_node_blockptr(c, 0, path->nodes[level - 1]->b_blocknr);
 
-        mark_buffer_dirty(t);
+        btrfs_mark_buffer_dirty(t);
 
         /* the super has an extra ref to root->node */
         btrfs_block_release(root, root->node);
@@ -712,13 +720,15 @@ static int insert_ptr(struct btrfs_trans_handle *trans, struct btrfs_root
         if (nritems == BTRFS_NODEPTRS_PER_BLOCK(root))
                 BUG();
         if (slot != nritems) {
-                memmove(lower->ptrs + slot + 1, lower->ptrs + slot,
-                        (nritems - slot) * sizeof(struct btrfs_key_ptr));
+                btrfs_memmove(root, lower, lower->ptrs + slot + 1,
+                              lower->ptrs + slot,
+                              (nritems - slot) * sizeof(struct btrfs_key_ptr));
         }
-        memcpy(&lower->ptrs[slot].key, key, sizeof(struct btrfs_disk_key));
+        btrfs_memcpy(root, lower, &lower->ptrs[slot].key,
+                     key, sizeof(struct btrfs_disk_key));
         btrfs_set_node_blockptr(lower, slot, blocknr);
         btrfs_set_header_nritems(&lower->header, nritems + 1);
-        mark_buffer_dirty(path->nodes[level]);
+        btrfs_mark_buffer_dirty(path->nodes[level]);
         return 0;
 }
 
@@ -761,14 +771,14 @@ static int split_node(struct btrfs_trans_handle *trans, struct btrfs_root
         btrfs_set_header_parentid(&split->header,
               btrfs_header_parentid(btrfs_buffer_header(root->node)));
         mid = (c_nritems + 1) / 2;
-        memcpy(split->ptrs, c->ptrs + mid,
-                (c_nritems - mid) * sizeof(struct btrfs_key_ptr));
+        btrfs_memcpy(root, split, split->ptrs, c->ptrs + mid,
+                     (c_nritems - mid) * sizeof(struct btrfs_key_ptr));
         btrfs_set_header_nritems(&split->header, c_nritems - mid);
         btrfs_set_header_nritems(&c->header, mid);
         ret = 0;
 
-        mark_buffer_dirty(t);
-        mark_buffer_dirty(split_buffer);
+        btrfs_mark_buffer_dirty(t);
+        btrfs_mark_buffer_dirty(split_buffer);
         wret = insert_ptr(trans, root, path, &split->ptrs[0].key,
                           split_buffer->b_blocknr, path->slots[level + 1] + 1,
                           level + 1);
@@ -875,17 +885,22 @@ static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
         push_space = btrfs_item_end(left->items + left_nritems - push_items);
         push_space -= leaf_data_end(root, left);
         /* make room in the right data area */
-        memmove(btrfs_leaf_data(right) + leaf_data_end(root, right) -
-                push_space, btrfs_leaf_data(right) + leaf_data_end(root, right),
-                BTRFS_LEAF_DATA_SIZE(root) - leaf_data_end(root, right));
+        btrfs_memmove(root, right, btrfs_leaf_data(right) +
+                      leaf_data_end(root, right) - push_space,
+                      btrfs_leaf_data(right) +
+                      leaf_data_end(root, right), BTRFS_LEAF_DATA_SIZE(root) -
+                      leaf_data_end(root, right));
         /* copy from the left data area */
-        memcpy(btrfs_leaf_data(right) + BTRFS_LEAF_DATA_SIZE(root) - push_space,
-                btrfs_leaf_data(left) + leaf_data_end(root, left), push_space);
-        memmove(right->items + push_items, right->items,
+        btrfs_memcpy(root, right, btrfs_leaf_data(right) +
+                     BTRFS_LEAF_DATA_SIZE(root) - push_space,
+                     btrfs_leaf_data(left) + leaf_data_end(root, left),
+                     push_space);
+        btrfs_memmove(root, right, right->items + push_items, right->items,
                 right_nritems * sizeof(struct btrfs_item));
         /* copy the items from left to right */
-        memcpy(right->items, left->items + left_nritems - push_items,
-                push_items * sizeof(struct btrfs_item));
+        btrfs_memcpy(root, right, right->items, left->items +
+                     left_nritems - push_items,
+                     push_items * sizeof(struct btrfs_item));
 
         /* update the item pointers */
         right_nritems += push_items;
@@ -899,11 +914,11 @@ static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
         left_nritems -= push_items;
         btrfs_set_header_nritems(&left->header, left_nritems);
 
-        mark_buffer_dirty(left_buf);
-        mark_buffer_dirty(right_buf);
-        memcpy(&upper_node->ptrs[slot + 1].key,
+        btrfs_mark_buffer_dirty(left_buf);
+        btrfs_mark_buffer_dirty(right_buf);
+        btrfs_memcpy(root, upper_node, &upper_node->ptrs[slot + 1].key,
                 &right->items[0].key, sizeof(struct btrfs_disk_key));
-        mark_buffer_dirty(upper);
+        btrfs_mark_buffer_dirty(upper);
 
         /* then fixup the leaf pointer in the path */
         if (path->slots[0] >= left_nritems) {
@@ -977,14 +992,16 @@ static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
                 return 1;
         }
         /* push data from right to left */
-        memcpy(left->items + btrfs_header_nritems(&left->header),
-                right->items, push_items * sizeof(struct btrfs_item));
+        btrfs_memcpy(root, left, left->items +
+                     btrfs_header_nritems(&left->header),
+                     right->items, push_items * sizeof(struct btrfs_item));
         push_space = BTRFS_LEAF_DATA_SIZE(root) -
                      btrfs_item_offset(right->items + push_items -1);
-        memcpy(btrfs_leaf_data(left) + leaf_data_end(root, left) - push_space,
-                btrfs_leaf_data(right) +
-                btrfs_item_offset(right->items + push_items - 1),
-                push_space);
+        btrfs_memcpy(root, left, btrfs_leaf_data(left) +
+                     leaf_data_end(root, left) - push_space,
+                     btrfs_leaf_data(right) +
+                     btrfs_item_offset(right->items + push_items - 1),
+                     push_space);
         old_left_nritems = btrfs_header_nritems(&left->header);
         BUG_ON(old_left_nritems < 0);
 
@@ -1000,10 +1017,11 @@ static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
         /* fixup right node */
         push_space = btrfs_item_offset(right->items + push_items - 1) -
                      leaf_data_end(root, right);
-        memmove(btrfs_leaf_data(right) + BTRFS_LEAF_DATA_SIZE(root) -
-                push_space, btrfs_leaf_data(right) +
-                leaf_data_end(root, right), push_space);
-        memmove(right->items, right->items + push_items,
+        btrfs_memmove(root, right, btrfs_leaf_data(right) +
+                      BTRFS_LEAF_DATA_SIZE(root) - push_space,
+                      btrfs_leaf_data(right) +
+                      leaf_data_end(root, right), push_space);
+        btrfs_memmove(root, right, right->items, right->items + push_items,
                 (btrfs_header_nritems(&right->header) - push_items) *
                 sizeof(struct btrfs_item));
         btrfs_set_header_nritems(&right->header,
@@ -1017,8 +1035,8 @@ static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
                 push_space = btrfs_item_offset(right->items + i);
         }
 
-        mark_buffer_dirty(t);
-        mark_buffer_dirty(right_buf);
+        btrfs_mark_buffer_dirty(t);
+        btrfs_mark_buffer_dirty(right_buf);
 
         wret = fixup_low_keys(trans, root, path, &right->items[0].key, 1);
         if (wret)
@@ -1110,11 +1128,12 @@ static int split_leaf(struct btrfs_trans_handle *trans, struct btrfs_root
               btrfs_header_parentid(btrfs_buffer_header(root->node)));
         data_copy_size = btrfs_item_end(l->items + mid) -
                          leaf_data_end(root, l);
-        memcpy(right->items, l->items + mid,
-               (nritems - mid) * sizeof(struct btrfs_item));
-        memcpy(btrfs_leaf_data(right) + BTRFS_LEAF_DATA_SIZE(root) -
-                data_copy_size, btrfs_leaf_data(l) +
-                leaf_data_end(root, l), data_copy_size);
+        btrfs_memcpy(root, right, right->items, l->items + mid,
+                     (nritems - mid) * sizeof(struct btrfs_item));
+        btrfs_memcpy(root, right,
+                     btrfs_leaf_data(right) + BTRFS_LEAF_DATA_SIZE(root) -
+                     data_copy_size, btrfs_leaf_data(l) +
+                     leaf_data_end(root, l), data_copy_size);
         rt_data_off = BTRFS_LEAF_DATA_SIZE(root) -
                       btrfs_item_end(l->items + mid);
 
@@ -1129,8 +1148,8 @@ static int split_leaf(struct btrfs_trans_handle *trans, struct btrfs_root
                           right_buffer->b_blocknr, path->slots[1] + 1, 1);
         if (wret)
                 ret = wret;
-        mark_buffer_dirty(right_buffer);
-        mark_buffer_dirty(l_buf);
+        btrfs_mark_buffer_dirty(right_buffer);
+        btrfs_mark_buffer_dirty(l_buf);
         BUG_ON(path->slots[0] != slot);
         if (mid <= slot) {
                 btrfs_block_release(root, path->nodes[0]);
@@ -1200,22 +1219,23 @@ int btrfs_insert_empty_item(struct btrfs_trans_handle *trans, struct btrfs_root
                 }
 
                 /* shift the items */
-                memmove(leaf->items + slot + 1, leaf->items + slot,
-                        (nritems - slot) * sizeof(struct btrfs_item));
+                btrfs_memmove(root, leaf, leaf->items + slot + 1,
+                              leaf->items + slot,
+                              (nritems - slot) * sizeof(struct btrfs_item));
 
                 /* shift the data */
-                memmove(btrfs_leaf_data(leaf) + data_end - data_size,
-                        btrfs_leaf_data(leaf) +
-                        data_end, old_data - data_end);
+                btrfs_memmove(root, leaf, btrfs_leaf_data(leaf) +
+                              data_end - data_size, btrfs_leaf_data(leaf) +
+                              data_end, old_data - data_end);
                 data_end = old_data;
         }
         /* setup the item for the new data */
-        memcpy(&leaf->items[slot].key, &disk_key,
-                sizeof(struct btrfs_disk_key));
+        btrfs_memcpy(root, leaf, &leaf->items[slot].key, &disk_key,
+                     sizeof(struct btrfs_disk_key));
         btrfs_set_item_offset(leaf->items + slot, data_end - data_size);
         btrfs_set_item_size(leaf->items + slot, data_size);
         btrfs_set_header_nritems(&leaf->header, nritems + 1);
-        mark_buffer_dirty(leaf_buf);
+        btrfs_mark_buffer_dirty(leaf_buf);
 
         ret = 0;
         if (slot == 0)
@@ -1245,8 +1265,9 @@ int btrfs_insert_item(struct btrfs_trans_handle *trans, struct btrfs_root
         if (!ret) {
                 ptr = btrfs_item_ptr(btrfs_buffer_leaf(path.nodes[0]),
                                      path.slots[0], u8);
-                memcpy(ptr, data, data_size);
-                mark_buffer_dirty(path.nodes[0]);
+                btrfs_memcpy(root, path.nodes[0]->b_data,
+                             ptr, data, data_size);
+                btrfs_mark_buffer_dirty(path.nodes[0]);
         }
         btrfs_release_path(root, &path);
         return ret;
@@ -1271,8 +1292,10 @@ static int del_ptr(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         node = btrfs_buffer_node(parent);
         nritems = btrfs_header_nritems(&node->header);
         if (slot != nritems -1) {
-                memmove(node->ptrs + slot, node->ptrs + slot + 1,
-                        sizeof(struct btrfs_key_ptr) * (nritems - slot - 1));
+                btrfs_memmove(root, node, node->ptrs + slot,
+                              node->ptrs + slot + 1,
+                              sizeof(struct btrfs_key_ptr) *
+                              (nritems - slot - 1));
         }
         nritems--;
         btrfs_set_header_nritems(&node->header, nritems);
@@ -1287,7 +1310,7 @@ static int del_ptr(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                 if (wret)
                         ret = wret;
         }
-        mark_buffer_dirty(parent);
+        btrfs_mark_buffer_dirty(parent);
         return ret;
 }
 
@@ -1317,16 +1340,18 @@ int btrfs_del_item(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         if (slot != nritems - 1) {
                 int i;
                 int data_end = leaf_data_end(root, leaf);
-                memmove(btrfs_leaf_data(leaf) + data_end + dsize,
-                        btrfs_leaf_data(leaf) + data_end,
-                        doff - data_end);
+                btrfs_memmove(root, leaf, btrfs_leaf_data(leaf) +
+                              data_end + dsize,
+                              btrfs_leaf_data(leaf) + data_end,
+                              doff - data_end);
                 for (i = slot + 1; i < nritems; i++) {
                         u32 ioff = btrfs_item_offset(leaf->items + i);
                         btrfs_set_item_offset(leaf->items + i, ioff + dsize);
                 }
-                memmove(leaf->items + slot, leaf->items + slot + 1,
-                        sizeof(struct btrfs_item) *
-                        (nritems - slot - 1));
+                btrfs_memmove(root, leaf, leaf->items + slot,
+                              leaf->items + slot + 1,
+                              sizeof(struct btrfs_item) *
+                              (nritems - slot - 1));
         }
         btrfs_set_header_nritems(&leaf->header, nritems - 1);
         nritems--;
@@ -1336,6 +1361,7 @@ int btrfs_del_item(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                         btrfs_set_header_level(&leaf->header, 0);
                 } else {
                         clean_tree_block(trans, root, leaf_buf);
+                        wait_on_buffer(leaf_buf);
                         wret = del_ptr(trans, root, path, 1, path->slots[1]);
                         if (wret)
                                 ret = wret;
@@ -1373,6 +1399,7 @@ int btrfs_del_item(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                         if (btrfs_header_nritems(&leaf->header) == 0) {
                                 u64 blocknr = leaf_buf->b_blocknr;
                                 clean_tree_block(trans, root, leaf_buf);
+                                wait_on_buffer(leaf_buf);
                                 wret = del_ptr(trans, root, path, 1, slot);
                                 if (wret)
                                         ret = wret;
@@ -1382,11 +1409,11 @@ int btrfs_del_item(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                                 if (wret)
                                         ret = wret;
                         } else {
-                                mark_buffer_dirty(leaf_buf);
+                                btrfs_mark_buffer_dirty(leaf_buf);
                                 btrfs_block_release(root, leaf_buf);
                         }
                 } else {
-                        mark_buffer_dirty(leaf_buf);
+                        btrfs_mark_buffer_dirty(leaf_buf);
                 }
         }
         return ret;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index df1a025a771c..9ec0d65ebe9b 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2,6 +2,7 @@
 #define __BTRFS__
 
 #include <linux/fs.h>
+#include <linux/buffer_head.h>
 #include "bit-radix.h"
 
 struct btrfs_trans_handle;
@@ -834,6 +835,37 @@ static inline struct btrfs_root *btrfs_sb(struct super_block *sb)
         return sb->s_fs_info;
 }
 
+static inline void btrfs_check_bounds(void *vptr, size_t len,
+                                     void *vcontainer, size_t container_len)
+{
+        char *ptr = vptr;
+        char *container = vcontainer;
+        WARN_ON(ptr < container);
+        WARN_ON(ptr + len > container + container_len);
+}
+
+static inline void btrfs_memcpy(struct btrfs_root *root,
+                                void *dst_block,
+                                void *dst, const void *src, size_t nr)
+{
+        btrfs_check_bounds(dst, nr, dst_block, root->fs_info->sb->s_blocksize);
+        memcpy(dst, src, nr);
+}
+
+static inline void btrfs_memmove(struct btrfs_root *root,
+                                void *dst_block,
+                                void *dst, void *src, size_t nr)
+{
+        btrfs_check_bounds(dst, nr, dst_block, root->fs_info->sb->s_blocksize);
+        memmove(dst, src, nr);
+}
+
+static inline void btrfs_mark_buffer_dirty(struct buffer_head *bh)
+{
+        WARN_ON(!atomic_read(&bh->b_count));
+        mark_buffer_dirty(bh);
+}
+
 /* helper function to cast into the data area of the leaf. */
 #define btrfs_item_ptr(leaf, slot, type) \
         ((type *)(btrfs_leaf_data(leaf) + \
diff --git a/fs/btrfs/dir-item.c b/fs/btrfs/dir-item.c
index 18d3e168ad0a..f55c89472ac0 100644
--- a/fs/btrfs/dir-item.c
+++ b/fs/btrfs/dir-item.c
@@ -34,10 +34,8 @@ int btrfs_insert_dir_item(struct btrfs_trans_handle *trans, struct btrfs_root
         btrfs_set_dir_flags(dir_item, 0);
         btrfs_set_dir_name_len(dir_item, name_len);
         name_ptr = (char *)(dir_item + 1);
-        memcpy(name_ptr, name, name_len);
-        if (name_ptr + name_len > path.nodes[0]->b_data + 4096)
-                WARN_ON(1);
-        mark_buffer_dirty(path.nodes[0]);
+        btrfs_memcpy(root, path.nodes[0]->b_data, name_ptr, name, name_len);
+        btrfs_mark_buffer_dirty(path.nodes[0]);
 out:
         btrfs_release_path(root, &path);
         return ret;
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 6c010463b9db..bb133104e2e9 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -8,6 +8,17 @@
 #include "disk-io.h"
 #include "transaction.h"
 
+#define PATTERN 0xDEADBEEFUL
+static inline void check_pattern(struct buffer_head *buf)
+{
+        if (buf->b_private != (void *)PATTERN)
+                WARN_ON(1);
+}
+
+static inline void set_pattern(struct buffer_head *buf)
+{
+        buf->b_private = (void *)PATTERN;
+}
 
 static int check_tree_block(struct btrfs_root *root, struct buffer_head *buf)
 {
@@ -51,8 +62,10 @@ struct buffer_head *btrfs_find_tree_block(struct btrfs_root *root, u64 blocknr)
         } while (bh != head);
 out_unlock:
         unlock_page(page);
-        if (ret)
+        if (ret) {
                 touch_buffer(ret);
+                check_pattern(ret);
+        }
         page_cache_release(page);
         return ret;
 }
@@ -82,6 +95,7 @@ struct buffer_head *btrfs_find_create_tree_block(struct btrfs_root *root,
                         bh->b_bdev = root->fs_info->sb->s_bdev;
                         bh->b_blocknr = first_block;
                         set_buffer_mapped(bh);
+                        set_pattern(bh);
                 }
                 if (bh->b_blocknr == blocknr) {
                         ret = bh;
@@ -225,6 +239,7 @@ struct buffer_head *read_tree_block(struct btrfs_root *root, u64 blocknr)
                 if (!buffer_uptodate(bh))
                         goto fail;
                 csum_tree_block(root, bh, 1);
+                set_pattern(bh);
         } else {
                 unlock_buffer(bh);
         }
@@ -240,6 +255,7 @@ fail:
 int dirty_tree_block(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                      struct buffer_head *buf)
 {
+        WARN_ON(atomic_read(&buf->b_count) == 0);
         mark_buffer_dirty(buf);
         return 0;
 }
@@ -247,6 +263,7 @@ int dirty_tree_block(struct btrfs_trans_handle *trans, struct btrfs_root *root,
 int clean_tree_block(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                      struct buffer_head *buf)
 {
+        WARN_ON(atomic_read(&buf->b_count) == 0);
         clear_buffer_dirty(buf);
         return 0;
 }
@@ -431,6 +448,7 @@ int close_ctree(struct btrfs_root *root)
 
 void btrfs_block_release(struct btrfs_root *root, struct buffer_head *buf)
 {
+        check_pattern(buf);
         brelse(buf);
 }
 
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index b2ae8e768b6c..c4194dab7a33 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -39,7 +39,7 @@ static int inc_block_ref(struct btrfs_trans_handle *trans, struct btrfs_root
         item = btrfs_item_ptr(l, path.slots[0], struct btrfs_extent_item);
         refs = btrfs_extent_refs(item);
         btrfs_set_extent_refs(item, refs + 1);
-        mark_buffer_dirty(path.nodes[0]);
+        btrfs_mark_buffer_dirty(path.nodes[0]);
 
         btrfs_release_path(root->fs_info->extent_root, &path);
         finish_current_insert(trans, root->fs_info->extent_root);
@@ -177,10 +177,10 @@ static int pin_down_block(struct btrfs_root *root, u64 blocknr, int pending)
                         header = btrfs_buffer_header(bh);
                         if (btrfs_header_generation(header) ==
                             root->fs_info->running_transaction->transid) {
-                                brelse(bh);
+                                btrfs_block_release(root, bh);
                                 return 0;
                         }
-                        brelse(bh);
+                        btrfs_block_release(root, bh);
                 }
                 err = set_radix_bit(&root->fs_info->pinned_radix, blocknr);
         } else {
@@ -224,7 +224,7 @@ static int __free_extent(struct btrfs_trans_handle *trans, struct btrfs_root
         BUG_ON(ei->refs == 0);
         refs = btrfs_extent_refs(ei) - 1;
         btrfs_set_extent_refs(ei, refs);
-        mark_buffer_dirty(path.nodes[0]);
+        btrfs_mark_buffer_dirty(path.nodes[0]);
         if (refs == 0) {
                 u64 super_blocks_used;
 
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
index 2d2c23ca7cbf..c3992b7b0c60 100644
--- a/fs/btrfs/file-item.c
+++ b/fs/btrfs/file-item.c
@@ -34,7 +34,7 @@ int btrfs_alloc_file_extent(struct btrfs_trans_handle *trans,
         btrfs_set_file_extent_offset(item, 0);
         btrfs_set_file_extent_num_blocks(item, ins.offset);
         btrfs_set_file_extent_generation(item, trans->transid);
-        mark_buffer_dirty(path.nodes[0]);
+        btrfs_mark_buffer_dirty(path.nodes[0]);
         *result = ins.objectid;
         btrfs_release_path(root, &path);
         return 0;
@@ -81,7 +81,7 @@ int btrfs_csum_file_block(struct btrfs_trans_handle *trans,
                               struct btrfs_csum_item);
         ret = 0;
         ret = btrfs_csum_data(root, data, len, item->csum);
-        mark_buffer_dirty(path.nodes[0]);
+        btrfs_mark_buffer_dirty(path.nodes[0]);
 fail:
         btrfs_release_path(root, &path);
         return ret;
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index 1b2c5e043508..fa4adb81b149 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -109,7 +109,7 @@ int btrfs_insert_inode_map(struct btrfs_trans_handle *trans,
         inode_item = btrfs_item_ptr(btrfs_buffer_leaf(path.nodes[0]),
                                     path.slots[0], struct btrfs_inode_map_item);
         btrfs_cpu_key_to_disk(&inode_item->key, location);
-        mark_buffer_dirty(path.nodes[0]);
+        btrfs_mark_buffer_dirty(path.nodes[0]);
 out:
         btrfs_release_path(inode_root, &path);
         return ret;
diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index a821b5d1e233..f37dab87de16 100644
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -45,6 +45,7 @@ int btrfs_update_root(struct btrfs_trans_handle *trans, struct btrfs_root
         struct btrfs_leaf *l;
         int ret;
         int slot;
+        struct btrfs_root_item *update_item;
 
         btrfs_init_path(&path);
         ret = btrfs_search_slot(trans, root, key, &path, 0, 1);
@@ -53,9 +54,9 @@ int btrfs_update_root(struct btrfs_trans_handle *trans, struct btrfs_root
         BUG_ON(ret != 0);
         l = btrfs_buffer_leaf(path.nodes[0]);
         slot = path.slots[0];
-        memcpy(btrfs_item_ptr(l, slot, struct btrfs_root_item), item,
-                sizeof(*item));
-        mark_buffer_dirty(path.nodes[0]);
+        update_item = btrfs_item_ptr(l, slot, struct btrfs_root_item);
+        btrfs_memcpy(root, l, update_item, item, sizeof(*item));
+        btrfs_mark_buffer_dirty(path.nodes[0]);
 out:
         btrfs_release_path(root, &path);
         return ret;
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index ab5419eea93a..894a70bf26d2 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -557,7 +557,7 @@ static int btrfs_update_inode(struct btrfs_trans_handle *trans,
                                   struct btrfs_inode_item);
 
         fill_inode_item(inode_item, inode);
-        mark_buffer_dirty(path.nodes[0]);
+        btrfs_mark_buffer_dirty(path.nodes[0]);
 failed:
         btrfs_release_path(root, &path);
         return 0;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index a146463c5049..84c4e278ce2e 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -66,6 +66,7 @@ int btrfs_end_transaction(struct btrfs_trans_handle *trans,
         cur_trans->num_writers--;
         put_transaction(cur_trans);
         mutex_unlock(&root->fs_info->trans_mutex);
+        memset(trans, 0, sizeof(*trans));
         kfree(trans);
         return 0;
 }