ceph: fix readpage from fscache

commit dd2bc473482eedc60c29cf00ad12568ce40ce511 upstream.

ceph_readpage() unlocks page prematurely prematurely in the case
that page is reading from fscache. Caller of readpage expects that
page is uptodate when it get unlocked. So page shoule get locked
by completion callback of fscache_read_or_alloc_pages()

Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index c6a1ec110c015c82784b17b55353015a63061796..22bae2b434e2cbff092af7ba7acb575fd5ea46fb 100644 (file)
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -189,7 +189,7 @@ static int ceph_releasepage(struct page *page, gfp_t g)
 /*
  * read a single page, without unlocking it.
  */
-static int readpage_nounlock(struct file *filp, struct page *page)
+static int ceph_do_readpage(struct file *filp, struct page *page)
 {
        struct inode *inode = file_inode(filp);
        struct ceph_inode_info *ci = ceph_inode(inode);
@@ -219,7 +219,7 @@ static int readpage_nounlock(struct file *filp, struct page *page)
 
        err = ceph_readpage_from_fscache(inode, page);
        if (err == 0)
-               goto out;
+               return -EINPROGRESS;
 
        dout("readpage inode %p file %p page %p index %lu\n",
             inode, filp, page, page->index);
@@ -249,8 +249,11 @@ out:
 
 static int ceph_readpage(struct file *filp, struct page *page)
 {
-       int r = readpage_nounlock(filp, page);
-       unlock_page(page);
+       int r = ceph_do_readpage(filp, page);
+       if (r != -EINPROGRESS)
+               unlock_page(page);
+       else
+               r = 0;
        return r;
 }
 
@@ -1094,7 +1097,7 @@ retry_locked:
                        goto retry_locked;
                r = writepage_nounlock(page, NULL);
                if (r < 0)
-                       goto fail_nosnap;
+                       goto fail_unlock;
                goto retry_locked;
        }
 
@@ -1122,11 +1125,14 @@ retry_locked:
        }
 
        /* we need to read it. */
-       r = readpage_nounlock(file, page);
-       if (r < 0)
-               goto fail_nosnap;
+       r = ceph_do_readpage(file, page);
+       if (r < 0) {
+               if (r == -EINPROGRESS)
+                       return -EAGAIN;
+               goto fail_unlock;
+       }
        goto retry_locked;
-fail_nosnap:
+fail_unlock:
        unlock_page(page);
        return r;
 }

diff --git a/fs/ceph/cache.c b/fs/ceph/cache.c
index a4766ded1ba78e8bbbff70d4c5e65b3f9060d687..ff1cfd7b10830b393b28bf327f7bb1125a9b8bac 100644 (file)
--- a/fs/ceph/cache.c
+++ b/fs/ceph/cache.c
@@ -224,13 +224,7 @@ void ceph_fscache_unregister_inode_cookie(struct ceph_inode_info* ci)
        fscache_relinquish_cookie(cookie, 0);
 }
 
-static void ceph_vfs_readpage_complete(struct page *page, void *data, int error)
-{
-       if (!error)
-               SetPageUptodate(page);
-}
-
-static void ceph_vfs_readpage_complete_unlock(struct page *page, void *data, int error)
+static void ceph_readpage_from_fscache_complete(struct page *page, void *data, int error)
 {
        if (!error)
                SetPageUptodate(page);
@@ -259,7 +253,7 @@ int ceph_readpage_from_fscache(struct inode *inode, struct page *page)
                return -ENOBUFS;
 
        ret = fscache_read_or_alloc_page(ci->fscache, page,
-                                        ceph_vfs_readpage_complete, NULL,
+                                        ceph_readpage_from_fscache_complete, NULL,
                                         GFP_KERNEL);
 
        switch (ret) {
@@ -288,7 +282,7 @@ int ceph_readpages_from_fscache(struct inode *inode,
                return -ENOBUFS;
 
        ret = fscache_read_or_alloc_pages(ci->fscache, mapping, pages, nr_pages,
-                                         ceph_vfs_readpage_complete_unlock,
+                                         ceph_readpage_from_fscache_complete,
                                          NULL, mapping_gfp_mask(mapping));
 
        switch (ret) {