This is a note to let you know that I've just added the patch titled btrfs: check the root node for uptodate before returning it to the 5.16-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: btrfs-check-the-root-node-for-uptodate-before-returning-it.patch and it can be found in the queue-5.16 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 120de408e4b97504a2d9b5ca534b383de2c73d49 Mon Sep 17 00:00:00 2001 From: Josef Bacik <josef@xxxxxxxxxxxxxx> Date: Wed, 24 Nov 2021 14:14:24 -0500 Subject: btrfs: check the root node for uptodate before returning it From: Josef Bacik <josef@xxxxxxxxxxxxxx> commit 120de408e4b97504a2d9b5ca534b383de2c73d49 upstream. Now that we clear the extent buffer uptodate if we fail to write it out we need to check to see if our root node is uptodate before we search down it. Otherwise we could return stale data (or potentially corrupt data that was caught by the write verification step) and think that the path is OK to search down. CC: stable@xxxxxxxxxxxxxxx # 5.4+ Reviewed-by: Nikolay Borisov <nborisov@xxxxxxxx> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx> Signed-off-by: David Sterba <dsterba@xxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/btrfs/ctree.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c @@ -1570,12 +1570,9 @@ static struct extent_buffer *btrfs_searc { struct btrfs_fs_info *fs_info = root->fs_info; struct extent_buffer *b; - int root_lock; + int root_lock = 0; int level = 0; - /* We try very hard to do read locks on the root */ - root_lock = BTRFS_READ_LOCK; - if (p->search_commit_root) { /* * The commit roots are read only so we always do read locks, @@ -1613,6 +1610,9 @@ static struct extent_buffer *btrfs_searc goto out; } + /* We try very hard to do read locks on the root */ + root_lock = BTRFS_READ_LOCK; + /* * If the level is set to maximum, we can skip trying to get the read * lock. @@ -1639,6 +1639,17 @@ static struct extent_buffer *btrfs_searc level = btrfs_header_level(b); out: + /* + * The root may have failed to write out at some point, and thus is no + * longer valid, return an error in this case. + */ + if (!extent_buffer_uptodate(b)) { + if (root_lock) + btrfs_tree_unlock_rw(b, root_lock); + free_extent_buffer(b); + return ERR_PTR(-EIO); + } + p->nodes[level] = b; if (!p->skip_locking) p->locks[level] = root_lock; Patches currently in stable-queue which might be from josef@xxxxxxxxxxxxxx are queue-5.16/btrfs-respect-the-max-size-in-the-header-when-activating-swap-file.patch queue-5.16/btrfs-check-the-root-node-for-uptodate-before-returning-it.patch queue-5.16/btrfs-remove-bug_on-eie-in-find_parent_nodes.patch queue-5.16/btrfs-remove-bug_on-in-find_parent_nodes.patch