Fix the problem (BUG 4964) with unmapped buffers in transaction's t_sync_data list. The problem is we need to call filesystem's own invalidatepage() from block_write_full_page(). block_write_full_page() must call filesystem's invalidatepage(). Otherwise following nasty race can happen: proc 1 proc 2 ------ ------ - write some new data to 'offset' => bh gets to the transactions data list - starts truncate => i_size set to new size - mpage_writepages() - ext3_ordered_writepage() to 'offset' - block_write_full_page() - page->index > end_index+1 - block_invalidatepage() - discard_buffer() - clear_buffer_mapped() - commit triggers and finds unmapped buffer - BOOM!
Unified · Split
| @@ -1637,6 +1637,15 @@ out: · 1636 unmodified lines | ||
| 1637 | 1637 | } |
| 1638 | 1638 | EXPORT_SYMBOL(block_invalidatepage); |
| 1639 | 1639 | |
| 1640 | +int do_invalidatepage(struct page *page, unsigned long offset) | |
| 1641 | +{ | |
| 1642 | + int (*invalidatepage)(struct page *, unsigned long); | |
| 1643 | + invalidatepage = page->mapping->a_ops->invalidatepage; | |
| 1644 | + if (invalidatepage == NULL) | |
| 1645 | + invalidatepage = block_invalidatepage; | |
| 1646 | + return (*invalidatepage)(page, offset); | |
| 1647 | +} | |
| 1648 | + | |
| 1640 | 1649 | /* |
| 1641 | 1650 | * We attach and possibly dirty the buffers atomically wrt |
| 1642 | 1651 | * __set_page_dirty_buffers() via private_lock. try_to_free_buffers |
| @@ -2696,7 +2705,7 @@ int block_write_full_page(struct page *page, get_block_t *get_block, · 1053 unmodified lines | ||
| 2696 | 2705 | * they may have been added in ext3_writepage(). Make them |
| 2697 | 2706 | * freeable here, so the page does not leak. |
| 2698 | 2707 | */ |
| 2699 | − block_invalidatepage(page, 0); | |
| 2708 | + do_invalidatepage(page, 0); | |
| 2700 | 2709 | unlock_page(page); |
| 2701 | 2710 | return 0; /* don't care */ |
| 2702 | 2711 | } |
| @@ -190,6 +190,7 @@ extern int buffer_heads_over_limit; · 189 unmodified lines | ||
| 190 | 190 | */ |
| 191 | 191 | int try_to_release_page(struct page * page, gfp_t gfp_mask); |
| 192 | 192 | int block_invalidatepage(struct page *page, unsigned long offset); |
| 193 | +int do_invalidatepage(struct page *page, unsigned long offset); | |
| 193 | 194 | int block_write_full_page(struct page *page, get_block_t *get_block, |
| 194 | 195 | struct writeback_control *wbc); |
| 195 | 196 | int block_read_full_page(struct page*, get_block_t*); |
| @@ -13,18 +13,9 @@ · 12 unmodified lines | ||
| 13 | 13 | #include <linux/pagemap.h> |
| 14 | 14 | #include <linux/pagevec.h> |
| 15 | 15 | #include <linux/buffer_head.h> /* grr. try_to_release_page, |
| 16 | − block_invalidatepage */ | |
| 16 | + do_invalidatepage */ | |
| 17 | 17 | |
| 18 | 18 | |
| 19 | −static int do_invalidatepage(struct page *page, unsigned long offset) | |
| 20 | −{ | |
| 21 | − int (*invalidatepage)(struct page *, unsigned long); | |
| 22 | − invalidatepage = page->mapping->a_ops->invalidatepage; | |
| 23 | − if (invalidatepage == NULL) | |
| 24 | − invalidatepage = block_invalidatepage; | |
| 25 | − return (*invalidatepage)(page, offset); | |
| 26 | −} | |
| 27 | − | |
| 28 | 19 | static inline void truncate_partial_page(struct page *page, unsigned partial) |
| 29 | 20 | { |
| 30 | 21 | memclear_highpage_flush(page, partial, PAGE_CACHE_SIZE-partial); |