btrfs: limit device extents to the device size

commit 3c538de0f2a74d50aff7278c092f88ae59cee688 upstream.

There was a recent regression in btrfs/177 that started happening with
the size class patches ("btrfs: introduce size class to block group
allocator").  This however isn't a regression introduced by those
patches, but rather the bug was uncovered by a change in behavior in
these patches.  The patches triggered more chunk allocations in the
^free-space-tree case, which uncovered a race with device shrink.

The problem is we will set the device total size to the new size, and
use this to find a hole for a device extent.  However during shrink we
may have device extents allocated past this range, so we could
potentially find a hole in a range past our new shrink size.  We don't
actually limit our found extent to the device size anywhere, we assume
that we will not find a hole past our device size.  This isn't true with
shrink as we're relocating block groups and thus creating holes past the
device size.

Fix this by making sure we do not search past the new device size, and
if we wander into any device extents that start after our device size
simply break from the loop and use whatever hole we've already found.

CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index f01549b8c7c5482069c9a02d862352a3812590cc..93bc7c09a81336b8889d17a29172f29d543f6f57 100644 (file)
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1646,7 +1646,7 @@ static int find_free_dev_extent_start(struct btrfs_device *device,
        if (ret < 0)
                goto out;
 
-       while (1) {
+       while (search_start < search_end) {
                l = path->nodes[0];
                slot = path->slots[0];
                if (slot >= btrfs_header_nritems(l)) {
@@ -1669,6 +1669,9 @@ static int find_free_dev_extent_start(struct btrfs_device *device,
                if (key.type != BTRFS_DEV_EXTENT_KEY)
                        goto next;
 
+               if (key.offset > search_end)
+                       break;
+
                if (key.offset > search_start) {
                        hole_size = key.offset - search_start;
                        dev_extent_hole_check(device, &search_start, &hole_size,
@@ -1729,6 +1732,7 @@ static int find_free_dev_extent_start(struct btrfs_device *device,
        else
                ret = 0;
 
+       ASSERT(max_hole_start + max_hole_size <= search_end);
 out:
        btrfs_free_path(path);
        *start = max_hole_start;