Commit afb51f81 authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] ext3 corruption fix

Stephen and Neil Brown recently worked this out.  It's a
rare situation which only affects data=journal mode.

Fix problem in data=journal mode where writeback could be left pending on a
journaled, deleted disk block.  If that block then gets reallocated, we can
end up with an alias in which the old data can be written back to disk over
the new.  Thanks to Neil Brown for spotting this and coming up with the
initial fix.
parent e3e529bf
...@@ -659,6 +659,20 @@ void journal_commit_transaction(journal_t *journal) ...@@ -659,6 +659,20 @@ void journal_commit_transaction(journal_t *journal)
* there's no point in keeping a checkpoint record for * there's no point in keeping a checkpoint record for
* it. */ * it. */
bh = jh2bh(jh); bh = jh2bh(jh);
/* A buffer which has been freed while still being
* journaled by a previous transaction may end up still
* being dirty here, but we want to avoid writing back
* that buffer in the future now that the last use has
* been committed. That's not only a performance gain,
* it also stops aliasing problems if the buffer is left
* behind for writeback and gets reallocated for another
* use in a different page. */
if (buffer_freed(bh)) {
clear_buffer_freed(bh);
clear_buffer_jbddirty(bh);
}
if (buffer_jdirty(bh)) { if (buffer_jdirty(bh)) {
JBUFFER_TRACE(jh, "add to new checkpointing trans"); JBUFFER_TRACE(jh, "add to new checkpointing trans");
__journal_insert_checkpoint(jh, commit_transaction); __journal_insert_checkpoint(jh, commit_transaction);
......
...@@ -1861,6 +1861,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh) ...@@ -1861,6 +1861,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
* running transaction if that is set, but nothing * running transaction if that is set, but nothing
* else. */ * else. */
JBUFFER_TRACE(jh, "on committing transaction"); JBUFFER_TRACE(jh, "on committing transaction");
set_buffer_freed(bh);
if (jh->b_next_transaction) { if (jh->b_next_transaction) {
J_ASSERT(jh->b_next_transaction == J_ASSERT(jh->b_next_transaction ==
journal->j_running_transaction); journal->j_running_transaction);
......
...@@ -238,6 +238,7 @@ enum jbd_state_bits { ...@@ -238,6 +238,7 @@ enum jbd_state_bits {
BUFFER_FNS(JBD, jbd) BUFFER_FNS(JBD, jbd)
BUFFER_FNS(JBDDirty, jbddirty) BUFFER_FNS(JBDDirty, jbddirty)
TAS_BUFFER_FNS(JBDDirty, jbddirty) TAS_BUFFER_FNS(JBDDirty, jbddirty)
BUFFER_FNS(Freed, freed)
static inline struct buffer_head *jh2bh(struct journal_head *jh) static inline struct buffer_head *jh2bh(struct journal_head *jh)
{ {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment