xfs_repair: take the ag_lock before recording rmap for a bmbt record

When the (threaded) inode scanner iterates the blocks of a bmbt tree and
wants to record the bmbt blocks in the in-core rmap database, we have to
take the ag_lock for the AG that the bmbt block is in, or else we can
accidentally corrupt the rmap slab by calling slab_add from two threads.

Reported-by: matorola@gmail.com
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>

diff --git a/repair/scan.c b/repair/scan.c
index 447611ac374ffda29cbb8bb5332d6b2a6ff85d94..9c0f2d6a10c358d49ee9d133d8fdafd4ae5cefd2 100644 (file)
--- a/repair/scan.c
+++ b/repair/scan.c
@@ -383,7 +383,10 @@ _("bad state %d, inode %" PRIu64 " bmap block 0x%" PRIx64 "\n"),
 
        /* Record BMBT blocks in the reverse-mapping data. */
        if (check_dups && collect_rmaps) {
+               agno = XFS_FSB_TO_AGNO(mp, bno);
+               pthread_mutex_lock(&ag_locks[agno].lock);
                error = rmap_add_bmbt_rec(mp, ino, whichfork, bno);
+               pthread_mutex_unlock(&ag_locks[agno].lock);
                if (error)
                        do_error(
 _("couldn't add inode %"PRIu64" bmbt block %"PRIu64" reverse-mapping data."),