Btrfs-progs: fix the mismatch of extent buffer's space

Now we set @refs to 2 on creating a new extent buffer, meanwhile we
allocate the needed free space, but we don't give enough free_extent_buffer()
to reduce the eb's references to zero so that the eb can finally be freed,
so the problem is we has decrease the referene count of backrefs to zero, which
ends up releasing the space occupied by the eb, and this space can be allocated
again for something else(another eb or disk), usually a crash(core dump) will
occur, I've hit a crash in rb_insert() because another eb re-use the space while
the original one is floating around.

We should do the same thing as the kernel code does, it's necessary to initialize
@refs to 1 instead of 2, this helps us get rid of the above problem.

Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <clm@fb.com>

3 files changed, 3 insertions, 1 deletions

diff --git a/btrfs-convert.c b/btrfs-convert.c
index ae10eed0..cb6ddd05 100644
--- a/btrfs-convert.c
+++ b/btrfs-convert.c
@@ -1634,6 +1634,7 @@ static int init_btrfs(struct btrfs_root *root)
 	ret = create_subvol(trans, root, BTRFS_DATA_RELOC_TREE_OBJECTID);
 	BUG_ON(ret);
 
+	extent_buffer_get(fs_info->csum_root->node);
 	ret = __btrfs_cow_block(trans, fs_info->csum_root,
 				fs_info->csum_root->node, NULL, 0, &tmp, 0, 0);
 	BUG_ON(ret);
diff --git a/extent_io.c b/extent_io.c
index ad07b9cd..a127e543 100644
--- a/extent_io.c
+++ b/extent_io.c
@@ -580,7 +580,7 @@ static struct extent_buffer *__alloc_extent_buffer(struct extent_io_tree *tree,
 
 	eb->start = bytenr;
 	eb->len = blocksize;
-	eb->refs = 2;
+	eb->refs = 1;
 	eb->flags = 0;
 	eb->tree = tree;
 	eb->fd = -1;
diff --git a/mkfs.c b/mkfs.c
index 33369f94..daabf132 100644
--- a/mkfs.c
+++ b/mkfs.c
@@ -165,6 +165,7 @@ static void __recow_root(struct btrfs_trans_handle *trans,
 	struct extent_buffer *tmp;
 
 	if (trans->transid != btrfs_root_generation(&root->root_item)) {
+		extent_buffer_get(root->node);
 		ret = __btrfs_cow_block(trans, root, root->node,
 					NULL, 0, &tmp, 0, 0);
 		BUG_ON(ret);