[PATCH] ext3 corruption fix

Stephen and Neil Brown recently worked this out.  It's a
rare situation which only affects data=journal mode.

Fix problem in data=journal mode where writeback could be left pending on a
journaled, deleted disk block.  If that block then gets reallocated, we can
end up with an alias in which the old data can be written back to disk over
the new.  Thanks to Neil Brown for spotting this and coming up with the
initial fix.

diff --git a/fs/jbd/commit.c b/fs/jbd/commit.c
index e4ce53b05a5591cca5e4b8bb4327c5fc9ee23197..2283894a81a64adf2c9e4c074d556c9ba1a27bdf 100644 (file)
--- a/fs/jbd/commit.c
+++ b/fs/jbd/commit.c
@@ -659,6 +659,20 @@ skip_commit:
                 * there's no point in keeping a checkpoint record for
                 * it. */
                bh = jh2bh(jh);
+
+               /* A buffer which has been freed while still being
+                * journaled by a previous transaction may end up still
+                * being dirty here, but we want to avoid writing back
+                * that buffer in the future now that the last use has
+                * been committed.  That's not only a performance gain,
+                * it also stops aliasing problems if the buffer is left
+                * behind for writeback and gets reallocated for another
+                * use in a different page. */
+               if (buffer_freed(bh)) {
+                       clear_buffer_freed(bh);
+                       clear_buffer_jbddirty(bh);
+               }
+                       
                if (buffer_jdirty(bh)) {
                        JBUFFER_TRACE(jh, "add to new checkpointing trans");
                        __journal_insert_checkpoint(jh, commit_transaction);

diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index 89c625bf9fa87e2a6708d0f86680065907e72d46..04f15abd8cb6bc942178ac7a7881c1945e337c70 100644 (file)
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -1861,6 +1861,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
                 * running transaction if that is set, but nothing
                 * else. */
                JBUFFER_TRACE(jh, "on committing transaction");
+               set_buffer_freed(bh);
                if (jh->b_next_transaction) {
                        J_ASSERT(jh->b_next_transaction ==
                                        journal->j_running_transaction);

diff --git a/include/linux/jbd.h b/include/linux/jbd.h
index 835d38c9dbfcc8fa69a41d3c91cc09ce18b81e83..683c1247fd709eea4e7e7943c6bb0b63f108ecc8 100644 (file)
--- a/include/linux/jbd.h
+++ b/include/linux/jbd.h
@@ -238,6 +238,7 @@ enum jbd_state_bits {
 BUFFER_FNS(JBD, jbd)
 BUFFER_FNS(JBDDirty, jbddirty)
 TAS_BUFFER_FNS(JBDDirty, jbddirty)
+BUFFER_FNS(Freed, freed)
 
 static inline struct buffer_head *jh2bh(struct journal_head *jh)
 {