3.10-stable patches

added patches:
	reiserfs-call-truncate_setsize-under-tailpack-mutex.patch

diff --git a/queue-3.10/reiserfs-call-truncate_setsize-under-tailpack-mutex.patch b/queue-3.10/reiserfs-call-truncate_setsize-under-tailpack-mutex.patch
new file mode 100644 (file)
index 0000000..66f93eb
--- /dev/null
+++ b/queue-3.10/reiserfs-call-truncate_setsize-under-tailpack-mutex.patch
@@ -0,0 +1,48 @@
+From 22e7478ddbcb670e33fab72d0bbe7c394c3a2c84 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Wed, 21 May 2014 13:28:07 -0400
+Subject: reiserfs: call truncate_setsize under tailpack mutex
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit 22e7478ddbcb670e33fab72d0bbe7c394c3a2c84 upstream.
+
+Prior to commit 0e4f6a791b1e (Fix reiserfs_file_release()), reiserfs
+truncates serialized on i_mutex. They mostly still do, with the exception
+of reiserfs_file_release. That blocks out other writers via the tailpack
+mutex and the inode openers counter adjusted in reiserfs_file_open.
+
+However, NFS will call reiserfs_setattr without having called ->open, so
+we end up with a race when nfs is calling ->setattr while another
+process is releasing the file. Ultimately, it triggers the
+BUG_ON(inode->i_size != new_file_size) check in maybe_indirect_to_direct.
+
+The solution is to pull the lock into reiserfs_setattr to encompass the
+truncate_setsize call as well.
+
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/reiserfs/inode.c |    8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/fs/reiserfs/inode.c
++++ b/fs/reiserfs/inode.c
+@@ -3211,8 +3211,14 @@ int reiserfs_setattr(struct dentry *dent
+           attr->ia_size != i_size_read(inode)) {
+               error = inode_newsize_ok(inode, attr->ia_size);
+               if (!error) {
++                      /*
++                       * Could race against reiserfs_file_release
++                       * if called from NFS, so take tailpack mutex.
++                       */
++                      mutex_lock(&REISERFS_I(inode)->tailpack);
+                       truncate_setsize(inode, attr->ia_size);
+-                      reiserfs_vfs_truncate_file(inode);
++                      reiserfs_truncate_file(inode, 1);
++                      mutex_unlock(&REISERFS_I(inode)->tailpack);
+               }
+       }
+ 

diff --git a/queue-3.10/series b/queue-3.10/series
index 82427cbd858e252997aebc6081b21924d8e4b1dd..b08fb9f14fbebed9a7c0ea000006e0b56a9e85cc 100644 (file)
--- a/queue-3.10/series
+++ b/queue-3.10/series
@@ -31,3 +31,4 @@ powerpc-64bit-sendfile-is-capped-at-2gb.patch
 powerpc-fix-typo-config_pmac.patch
 powerpc-fix-typo-config_ppc_cpu.patch
 powerpc-add-at_hwcap2-to-indicate-v.crypto-category-support.patch
+reiserfs-call-truncate_setsize-under-tailpack-mutex.patch