Fix the problem (BUG 4964) with unmapped buffers in transaction's t_sync_data list. The problem is we need to call filesystem's own invalidatepage() from block_write_full_page(). block_write_full_page() must call filesystem's invalidatepage(). Otherwise following nasty race can happen: proc 1 proc 2 ------ ------ - write some new data to 'offset' => bh gets to the transactions data list - starts truncate => i_size set to new size - mpage_writepages() - ext3_ordered_writepage() to 'offset' - block_write_full_page() - page->index > end_index+1 - block_invalidatepage() - discard_buffer() - clear_buffer_mapped() - commit triggers and finds unmapped buffer - BOOM!
Unified · Split
| @@ -1637,6 +1637,15 @@ out: · 1636 unmodified lines | |||
| 1637 | } | 1637 | } |
| 1638 | EXPORT_SYMBOL(block_invalidatepage); | 1638 | EXPORT_SYMBOL(block_invalidatepage); |
| 1639 | 1639 | ||
| 1640 | int do_invalidatepage(struct page *page, unsigned long offset) | ||
| 1641 | { | ||
| 1642 | int (*invalidatepage)(struct page *, unsigned long); | ||
| 1643 | invalidatepage = page->mapping->a_ops->invalidatepage; | ||
| 1644 | if (invalidatepage == NULL) | ||
| 1645 | invalidatepage = block_invalidatepage; | ||
| 1646 | return (*invalidatepage)(page, offset); | ||
| 1647 | } | ||
| 1648 | |||
| 1640 | /* | 1649 | /* |
| 1641 | * We attach and possibly dirty the buffers atomically wrt | 1650 | * We attach and possibly dirty the buffers atomically wrt |
| 1642 | * __set_page_dirty_buffers() via private_lock. try_to_free_buffers | 1651 | * __set_page_dirty_buffers() via private_lock. try_to_free_buffers |
| @@ -2696,7 +2705,7 @@ int block_write_full_page(struct page *page, get_block_t *get_block, · 1053 unmodified lines | |||
| 2696 | * they may have been added in ext3_writepage(). Make them | 2705 | * they may have been added in ext3_writepage(). Make them |
| 2697 | * freeable here, so the page does not leak. | 2706 | * freeable here, so the page does not leak. |
| 2698 | */ | 2707 | */ |
| 2699 | block_invalidatepage(page, 0); | 2708 | do_invalidatepage(page, 0); |
| 2700 | unlock_page(page); | 2709 | unlock_page(page); |
| 2701 | return 0; /* don't care */ | 2710 | return 0; /* don't care */ |
| 2702 | } | 2711 | } |
| @@ -190,6 +190,7 @@ extern int buffer_heads_over_limit; · 189 unmodified lines | |||
| 190 | */ | 190 | */ |
| 191 | int try_to_release_page(struct page * page, gfp_t gfp_mask); | 191 | int try_to_release_page(struct page * page, gfp_t gfp_mask); |
| 192 | int block_invalidatepage(struct page *page, unsigned long offset); | 192 | int block_invalidatepage(struct page *page, unsigned long offset); |
| 193 | int do_invalidatepage(struct page *page, unsigned long offset); | ||
| 193 | int block_write_full_page(struct page *page, get_block_t *get_block, | 194 | int block_write_full_page(struct page *page, get_block_t *get_block, |
| 194 | struct writeback_control *wbc); | 195 | struct writeback_control *wbc); |
| 195 | int block_read_full_page(struct page*, get_block_t*); | 196 | int block_read_full_page(struct page*, get_block_t*); |
| @@ -13,18 +13,9 @@ · 12 unmodified lines | |||
| 13 | #include <linux/pagemap.h> | 13 | #include <linux/pagemap.h> |
| 14 | #include <linux/pagevec.h> | 14 | #include <linux/pagevec.h> |
| 15 | #include <linux/buffer_head.h> /* grr. try_to_release_page, | 15 | #include <linux/buffer_head.h> /* grr. try_to_release_page, |
| 16 | block_invalidatepage */ | 16 | do_invalidatepage */ |
| 17 | 17 | ||
| 18 | 18 | ||
| 19 | static int do_invalidatepage(struct page *page, unsigned long offset) | ||
| 20 | { | ||
| 21 | int (*invalidatepage)(struct page *, unsigned long); | ||
| 22 | invalidatepage = page->mapping->a_ops->invalidatepage; | ||
| 23 | if (invalidatepage == NULL) | ||
| 24 | invalidatepage = block_invalidatepage; | ||
| 25 | return (*invalidatepage)(page, offset); | ||
| 26 | } | ||
| 27 | |||
| 28 | static inline void truncate_partial_page(struct page *page, unsigned partial) | 19 | static inline void truncate_partial_page(struct page *page, unsigned partial) |
| 29 | { | 20 | { |
| 30 | memclear_highpage_flush(page, partial, PAGE_CACHE_SIZE-partial); | 21 | memclear_highpage_flush(page, partial, PAGE_CACHE_SIZE-partial); |