lustre/kernel_patches/patches/jbd-check-for-unmapped-buffer.patch

   1 Date: Mon, 23 Oct 2006 15:40:48 -0500
   2 From: Eric Sandeen <sandeen@redhat.com>
   3 Subject: [PATCH RHEL5] handle races w/ truncate in journal_dirty_data()
   4
   5 This is for BZ 209647 <https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=209647>: ext3/jbd panic
   6
   7 This patch is now in -mm.
   8
   9 When running several fsx's and other filesystem stress tests, we found
  10 cases where an unmapped buffer was still being sent to submit_bh by the
  11 ext3 dirty data journaling code.
  12
  13 I saw this happen in two ways, both related to another thread doing a
  14 truncate which would unmap the buffer in question.
  15
  16 Either we would get into journal_dirty_data with a bh which was already
  17 unmapped (although journal_dirty_data_fn had checked for this earlier, the
  18 state was not locked at that point), or it would get unmapped in the middle
  19 of journal_dirty_data when we dropped locks to call sync_dirty_buffer.
  20
  21 By re-checking for mapped state after we've acquired the bh state lock, we
  22 should avoid these races.  If we find a buffer which is no longer mapped,
  23 we essentially ignore it, because journal_unmap_buffer has already decided
  24 that this buffer can go away.
  25
  26 I've also added tracepoints in these two cases, and made a couple other
  27 tracepoint changes that I found useful in debugging this.
  28
  29 Signed-off-by: Eric Sandeen <esandeen@redhat.com>
  30 Cc: <linux-ext4@vger.kernel.org>
  31 Signed-off-by: Andrew Morton <akpm@osdl.org>
  32 ---
  33
  34  fs/jbd/transaction.c |   15 ++++++++++++++-
  35  1 file changed, 14 insertions(+), 1 deletion(-)
  36
  37 Index: linux-2.6.18-1.2732.el5/fs/jbd/transaction.c
  38 ===================================================================
  39 --- linux-2.6.18-1.2732.el5.orig/fs/jbd/transaction.c
  40 +++ linux-2.6.18-1.2732.el5/fs/jbd/transaction.c
  41 @@ -967,6 +967,13 @@ int journal_dirty_data(handle_t *handle,
  42          */
  43         jbd_lock_bh_state(bh);
  44         spin_lock(&journal->j_list_lock);
  45 +
  46 +       /* Now that we have bh_state locked, are we really still mapped? */
  47 +       if (!buffer_mapped(bh)) {
  48 +               JBUFFER_TRACE(jh, "unmapped buffer, bailing out");
  49 +               goto no_journal;
  50 +       }
  51 +
  52         if (jh->b_transaction) {
  53                 JBUFFER_TRACE(jh, "has transaction");
  54                 if (jh->b_transaction != handle->h_transaction) {
  55 @@ -1028,6 +1035,11 @@ int journal_dirty_data(handle_t *handle,
  56                                 sync_dirty_buffer(bh);
  57                                 jbd_lock_bh_state(bh);
  58                                 spin_lock(&journal->j_list_lock);
  59 +                               /* Since we dropped the lock... */
  60 +                               if (!buffer_mapped(bh)) {
  61 +                                       JBUFFER_TRACE(jh, "buffer got unmapped");
  62 +                                       goto no_journal;
  63 +                               }
  64                                 /* The buffer may become locked again at any
  65                                    time if it is redirtied */
  66                         }
  67 @@ -1823,6 +1835,7 @@ static int journal_unmap_buffer(journal_
  68                         }
  69                 }
  70         } else if (transaction == journal->j_committing_transaction) {
  71 +               JBUFFER_TRACE(jh, "on committing transaction");
  72                 if (jh->b_jlist == BJ_Locked) {
  73                         /*
  74                          * The buffer is on the committing transaction's locked
  75 @@ -1837,7 +1850,6 @@ static int journal_unmap_buffer(journal_
  76                  * can remove it's next_transaction pointer from the
  77                  * running transaction if that is set, but nothing
  78                  * else. */
  79 -               JBUFFER_TRACE(jh, "on committing transaction");
  80                 set_buffer_freed(bh);
  81                 if (jh->b_next_transaction) {
  82                         J_ASSERT(jh->b_next_transaction ==
  83 @@ -1857,6 +1869,7 @@ static int journal_unmap_buffer(journal_
  84                  * i_size already for this truncate so recovery will not
  85                  * expose the disk blocks we are discarding here.) */
  86                 J_ASSERT_JH(jh, transaction == journal->j_running_transaction);
  87 +               JBUFFER_TRACE(jh, "on running transaction");
  88                 may_free = __dispose_buffer(jh, transaction);
  89         }
  90
  91