btrfs-progs: Fix negative eb's ref_cnt in btrfs-calc-size

btrfs-calc-size show following warning:
 # btrfs-calc-size /dev/sda6
 Calculating size of root tree
 ...
 extent_io.c:582: free_extent_buffer: Assertion `eb->refs < 0` failed.
 ./btrfs-calc-size[0x41d642]
 ./btrfs-calc-size(free_extent_buffer+0x70)[0x41e1c1]
 ./btrfs-calc-size(btrfs_free_fs_root+0x11)[0x40e1e8]
 ./btrfs-calc-size[0x40e215]
 ./btrfs-calc-size(rb_free_nodes+0x1d)[0x4326fe]
 ./btrfs-calc-size(close_ctree+0x3f3)[0x40f9ea]
 ./btrfs-calc-size(main+0x200)[0x431b4e]
 /lib64/libc.so.6(__libc_start_main+0xf5)[0x3858621d65]
 ./btrfs-calc-size[0x407009]

Reason:
 path in calc_root_size() is only used to save node data,
 it don't hold ref_cnt for each eb in.
 Using btrfs_free_path() to free path will reduce these eb
 again, and cause many problems, as negative ref_cnt or
 invalid memory access.

Signed-off-by: Zhao Lei <zhaolei@cn.fujitsu.com>
Signed-off-by: David Sterba <dsterba@suse.com>

1 files changed, 8 insertions, 1 deletions

diff --git a/btrfs-calc-size.c b/btrfs-calc-size.c
index 17d44ae1..b84cda95 100644
--- a/btrfs-calc-size.c
+++ b/btrfs-calc-size.c
@@ -417,7 +417,14 @@ out:
 		free(seek);
 	}
 
-	btrfs_free_path(path);
+	/*
+	 * We only use path to save node data in iterating,
+	 * without holding eb's ref_cnt in path.
+	 * Don't use btrfs_free_path() here, it will free these
+	 * eb again, and cause many problems, as negative ref_cnt
+	 * or invalid memory access.
+	 */
+	free(path);
 	return ret;
 }