Btrfs: fix the race between reading and updating devices

On btrfs_congested_fn and __unplug_io_fn paths, we should hold
device_list_mutex to avoid remove/add device path to
update fs_devices->devices

On __btrfs_close_devices and btrfs_prepare_sprout paths, the devices in
fs_devices->devices or fs_devices->devices is updated, so we should hold
the mutex to avoid the reader side to reach them

Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

2 files changed, 9 insertions, 0 deletions

diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 64b289690f9d..4e53a4fc467f 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1410,6 +1410,7 @@ static int btrfs_congested_fn(void *congested_data, int bdi_bits)
         struct btrfs_device *device;
         struct backing_dev_info *bdi;
 
+        mutex_lock(&info->fs_devices->device_list_mutex);
         list_for_each_entry(device, &info->fs_devices->devices, dev_list) {
                 if (!device->bdev)
                         continue;
@@ -1419,6 +1420,7 @@ static int btrfs_congested_fn(void *congested_data, int bdi_bits)
                         break;
                 }
         }
+        mutex_unlock(&info->fs_devices->device_list_mutex);
         return ret;
 }
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 290100fc47be..43c4f09e441c 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -481,6 +481,7 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
         if (--fs_devices->opened > 0)
                 return 0;
 
+        mutex_lock(&fs_devices->device_list_mutex);
         list_for_each_entry(device, &fs_devices->devices, dev_list) {
                 if (device->bdev) {
                         blkdev_put(device->bdev, device->mode);
@@ -495,6 +496,8 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
                 device->writeable = 0;
                 device->in_fs_metadata = 0;
         }
+        mutex_unlock(&fs_devices->device_list_mutex);
+
         WARN_ON(fs_devices->open_devices);
         WARN_ON(fs_devices->rw_devices);
         fs_devices->opened = 0;
@@ -1415,7 +1418,11 @@ static int btrfs_prepare_sprout(struct btrfs_trans_handle *trans,
         INIT_LIST_HEAD(&seed_devices->devices);
         INIT_LIST_HEAD(&seed_devices->alloc_list);
         mutex_init(&seed_devices->device_list_mutex);
+
+        mutex_lock(&root->fs_info->fs_devices->device_list_mutex);
         list_splice_init(&fs_devices->devices, &seed_devices->devices);
+        mutex_unlock(&root->fs_info->fs_devices->device_list_mutex);
+
         list_splice_init(&fs_devices->alloc_list, &seed_devices->alloc_list);
         list_for_each_entry(device, &seed_devices->devices, dev_list) {
                 device->fs_devices = seed_devices;