On Tue, Aug 13, 2019 at 10:33:44AM -0700, Omar Sandoval wrote:
> From: Omar Sandoval <osan...@fb.com>
>
> Commit ac0c7cf8be00 ("btrfs: fix crash when tracepoint arguments are
> freed by wq callbacks") added a void pointer, wtag, which is passed into
> trace_btrfs_all_work_done() instead of the freed work item. This is
> silly for a few reasons:
>
> 1. The freed work item still has the same address.
> 2. work is still in scope after it's freed, so assigning wtag doesn't
> stop anyone from using it.
> 3. The tracepoint has always taken a void * argument, so assigning wtag
> doesn't actually make things any more type-safe. (Note that the
> original bug in commit bc074524e123 ("btrfs: prefix fsid to all trace
> events") was that the void * was implicitly casted when it was passed
> to btrfs_work_owner() in the trace point itself).
I'd argue that the patch did it the way to prevent silly errors like
reusing 'work' because see it's passed to the tracepoint so it's fine to
use any time later as well. The value of the pointer was just something
to grep for not meant to be used in any other way.
> Instead, let's add some clearer warnings as comments.
>
> Reviewed-by: Nikolay Borisov <nbori...@suse.com>
> Reviewed-by: Filipe Manana <fdman...@suse.com>
> Signed-off-by: Omar Sandoval <osan...@fb.com>
> ---
> fs/btrfs/async-thread.c | 21 ++++++++-------------
> include/trace/events/btrfs.h | 6 +++---
> 2 files changed, 11 insertions(+), 16 deletions(-)
>
> diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
> index d105d3df6fa6..60319075b781 100644
> --- a/fs/btrfs/async-thread.c
> +++ b/fs/btrfs/async-thread.c
> @@ -226,7 +226,6 @@ static void run_ordered_work(struct btrfs_work *self)
> struct btrfs_work *work;
> spinlock_t *lock = &wq->list_lock;
> unsigned long flags;
> - void *wtag;
> bool free_self = false;
>
> while (1) {
> @@ -281,21 +280,19 @@ static void run_ordered_work(struct btrfs_work *self)
> } else {
> /*
> * We don't want to call the ordered free functions with
> - * the lock held though. Save the work as tag for the
> - * trace event, because the callback could free the
> - * structure.
> + * the lock held.
> */
> - wtag = work;
> work->ordered_free(work);
> - trace_btrfs_all_work_done(wq->fs_info, wtag);
> + /* NB: work must not be dereferenced past this point. */
> + trace_btrfs_all_work_done(wq->fs_info, work);
I hope that programmers read code and comments so what you do is fine
too and we don't have to reset work to NULL at this point, though this
would make it really hard to miss.
