releases/2.6.38.8/jbd-fix-fsync-tid-wraparound-bug.patch

   1 From d9b01934d56a96d9f4ae2d6204d4ea78a36f5f36 Mon Sep 17 00:00:00 2001
   2 From: Ted Ts'o <tytso@mit.edu>
   3 Date: Sat, 30 Apr 2011 13:17:11 -0400
   4 Subject: jbd: fix fsync() tid wraparound bug
   5
   6 From: Ted Ts'o <tytso@mit.edu>
   7
   8 commit d9b01934d56a96d9f4ae2d6204d4ea78a36f5f36 upstream.
   9
  10 If an application program does not make any changes to the indirect
  11 blocks or extent tree, i_datasync_tid will not get updated.  If there
  12 are enough commits (i.e., 2**31) such that tid_geq()'s calculations
  13 wrap, and there isn't a currently active transaction at the time of
  14 the fdatasync() call, this can end up triggering a BUG_ON in
  15 fs/jbd/commit.c:
  16
  17         J_ASSERT(journal->j_running_transaction != NULL);
  18
  19 It's pretty rare that this can happen, since it requires the use of
  20 fdatasync() plus *very* frequent and excessive use of fsync().  But
  21 with the right workload, it can.
  22
  23 We fix this by replacing the use of tid_geq() with an equality test,
  24 since there's only one valid transaction id that is valid for us to
  25 start: namely, the currently running transaction (if it exists).
  26
  27 Reported-by: Martin_Zielinski@McAfee.com
  28 Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
  29 Signed-off-by: Jan Kara <jack@suse.cz>
  30 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  31
  32 ---
  33  fs/jbd/journal.c |   16 +++++++++++++---
  34  1 file changed, 13 insertions(+), 3 deletions(-)
  35
  36 --- a/fs/jbd/journal.c
  37 +++ b/fs/jbd/journal.c
  38 @@ -437,9 +437,12 @@ int __log_space_left(journal_t *journal)
  39  int __log_start_commit(journal_t *journal, tid_t target)
  40  {
  41         /*
  42 -        * Are we already doing a recent enough commit?
  43 +        * The only transaction we can possibly wait upon is the
  44 +        * currently running transaction (if it exists).  Otherwise,
  45 +        * the target tid must be an old one.
  46          */
  47 -       if (!tid_geq(journal->j_commit_request, target)) {
  48 +       if (journal->j_running_transaction &&
  49 +           journal->j_running_transaction->t_tid == target) {
  50                 /*
  51                  * We want a new commit: OK, mark the request and wakeup the
  52                  * commit thread.  We do _not_ do the commit ourselves.
  53 @@ -451,7 +454,14 @@ int __log_start_commit(journal_t *journa
  54                           journal->j_commit_sequence);
  55                 wake_up(&journal->j_wait_commit);
  56                 return 1;
  57 -       }
  58 +       } else if (!tid_geq(journal->j_commit_request, target))
  59 +               /* This should never happen, but if it does, preserve
  60 +                  the evidence before kjournald goes into a loop and
  61 +                  increments j_commit_sequence beyond all recognition. */
  62 +               WARN_ONCE(1, "jbd: bad log_start_commit: %u %u %u %u\n",
  63 +                   journal->j_commit_request, journal->j_commit_sequence,
  64 +                   target, journal->j_running_transaction ?
  65 +                   journal->j_running_transaction->t_tid : 0);
  66         return 0;
  67  }
  68