Commit aaa4059b authored by Jan Kara's avatar Jan Kara Committed by Linus Torvalds
Browse files

[PATCH] ext3: Fix unmapped buffers in transaction's lists 



Fix the problem (BUG 4964) with unmapped buffers in transaction's
t_sync_data list.  The problem is we need to call filesystem's own
invalidatepage() from block_write_full_page().

block_write_full_page() must call filesystem's invalidatepage().  Otherwise
following nasty race can happen:

   proc 1                                        proc 2
   ------                                        ------
- write some new data to 'offset'
  => bh gets to the transactions data list
                                              - starts truncate
                                                => i_size set to new size
- mpage_writepages()
  - ext3_ordered_writepage() to 'offset'
    - block_write_full_page()
      - page->index > end_index+1
        - block_invalidatepage()
          - discard_buffer()
            - clear_buffer_mapped()

- commit triggers and finds unmapped buffer - BOOM!

Signed-off-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent e812cb52

fs/buffer.c

+10 −1
Original line number Diff line number Diff line
@@ -1637,6 +1637,15 @@ out: 
}

EXPORT_SYMBOL(block_invalidatepage);



int do_invalidatepage(struct page *page, unsigned long offset)

{

	int (*invalidatepage)(struct page *, unsigned long);

	invalidatepage = page->mapping->a_ops->invalidatepage;

	if (invalidatepage == NULL)

		invalidatepage = block_invalidatepage;

	return (*invalidatepage)(page, offset);

}



/*

 * We attach and possibly dirty the buffers atomically wrt

 * __set_page_dirty_buffers() via private_lock.  try_to_free_buffers
@@ -2696,7 +2705,7 @@ int block_write_full_page(struct page *page, get_block_t *get_block, 
		 * they may have been added in ext3_writepage().  Make them

		 * freeable here, so the page does not leak.

		 */

		block_invalidatepage(page, 0);

		do_invalidatepage(page, 0);

		unlock_page(page);

		return 0; /* don't care */

	}

include/linux/buffer_head.h

+1 −0
Original line number Diff line number Diff line
@@ -190,6 +190,7 @@ extern int buffer_heads_over_limit; 
 */

int try_to_release_page(struct page * page, gfp_t gfp_mask);

int block_invalidatepage(struct page *page, unsigned long offset);

int do_invalidatepage(struct page *page, unsigned long offset);

int block_write_full_page(struct page *page, get_block_t *get_block,

				struct writeback_control *wbc);

int block_read_full_page(struct page*, get_block_t*);

mm/truncate.c

+1 −10
Original line number Diff line number Diff line
@@ -13,18 +13,9 @@ 
#include <linux/pagemap.h>

#include <linux/pagevec.h>

#include <linux/buffer_head.h>	/* grr. try_to_release_page,

				   block_invalidatepage */

				   do_invalidatepage */





static int do_invalidatepage(struct page *page, unsigned long offset)

{

	int (*invalidatepage)(struct page *, unsigned long);

	invalidatepage = page->mapping->a_ops->invalidatepage;

	if (invalidatepage == NULL)

		invalidatepage = block_invalidatepage;

	return (*invalidatepage)(page, offset);

}



static inline void truncate_partial_page(struct page *page, unsigned partial)

{

	memclear_highpage_flush(page, partial, PAGE_CACHE_SIZE-partial);

CRA Git | Maintained and supported by SUSTech CRA and CCSE