Btrfs: Avoid extent_buffer lru corruption

Signed-off-by: Chris Mason <chris.mason@oracle.com>

fs/btrfs/extent_map.c

diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index c976615..754bc42 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -2047,7 +2047,7 @@
 			rm = list_entry(tree->buffer_lru.prev,
 					struct extent_buffer, lru);
 			tree->lru_size--;
-			list_del(&rm->lru);
+			list_del_init(&rm->lru);
 			free_extent_buffer(rm);
 		}
 	} else
@@ -2187,6 +2187,9 @@
 	return eb;
 
 fail:
+	spin_lock(&tree->lru_lock);
+	list_del_init(&eb->lru);
+	spin_unlock(&tree->lru_lock);
 	if (!atomic_dec_and_test(&eb->refs))
 		return NULL;
 	for (index = 0; index < i; index++) {
@@ -2246,6 +2249,9 @@
 	spin_unlock(&tree->lru_lock);
 	return eb;
 fail:
+	spin_lock(&tree->lru_lock);
+	list_del_init(&eb->lru);
+	spin_unlock(&tree->lru_lock);
 	if (!atomic_dec_and_test(&eb->refs))
 		return NULL;
 	for (index = 0; index < i; index++) {