rpms/kernel/F-9 linux-2.6-xfs-small-buffer-reads.patch, NONE, 1.1 kernel.spec, 1.639, 1.640
Eric Sandeen (sandeen)
fedora-extras-commits at redhat.com
Fri May 16 21:39:00 UTC 2008
Author: sandeen
Update of /cvs/pkgs/rpms/kernel/F-9
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv1800
Modified Files:
kernel.spec
Added Files:
linux-2.6-xfs-small-buffer-reads.patch
Log Message:
* Fri May 16 2008 Eric Sandeen <esandeen at redhat.com>
- xfs: Fix memory corruption with small buffer reads (kernel.org #10421)
linux-2.6-xfs-small-buffer-reads.patch:
--- NEW FILE linux-2.6-xfs-small-buffer-reads.patch ---
Fix memory corruption with small buffer reads
When we have multiple buffers in a single page for a blocksize == pagesize
filesystem we might overwrite the page contents if two callers hit it
shortly after each other. To prevent that we need to keep the page
locked until I/O is completed and the page marked uptodate.
Thanks to Eric Sandeen for triaging this bug and finding a reproducible
testcase and Dave Chinner for additional advice.
This should fix kernel.org bz #10421.
Signed-off-by: Christoph Hellwig <hch at lst.de>
Tested-by: Eric Sandeen <sandeen at sandeen.net>
Date: Fri May 16 12:10:56 AEST 2008
Workarea: chook.melbourne.sgi.com:/build/dgc/isms/2.6.x-xfs
Inspected by: hch at lst.de
The following file(s) were checked into:
longdrop.melbourne.sgi.com:/isms/linux/2.6.x-xfs-melb
Modid: xfs-linux-melb:xfs-kern:31173a
fs/xfs/linux-2.6/xfs_buf.h - 1.125 - changed
http://oss.sgi.com/cgi-bin/cvsweb.cgi/linux/fs/xfs-2.6/xfs_buf.h.diff?r1=text&tr1=1.125&r2=text&tr2=1.124&f=h
- Reintroduce page locking for sub-blocksize buffer read synchronisation.
fs/xfs/linux-2.6/xfs_buf.c - 1.256 - changed
http://oss.sgi.com/cgi-bin/cvsweb.cgi/linux/fs/xfs-2.6/xfs_buf.c.diff?r1=text&tr1=1.256&r2=text&tr2=1.255&f=h
- Reintroduce page locking for sub-blocksize buffer read synchronisation.
--- linux.orig/fs/xfs/linux-2.6/xfs_buf.h 2008/04/10 04:27:53 1.124
+++ linux/fs/xfs/linux-2.6/xfs_buf.h 2008/05/16 04:28:49 1.125
@@ -66,6 +66,25 @@ typedef enum {
_XBF_PAGES = (1 << 18), /* backed by refcounted pages */
_XBF_RUN_QUEUES = (1 << 19),/* run block device task queue */
_XBF_DELWRI_Q = (1 << 21), /* buffer on delwri queue */
+
+ /*
+ * Special flag for supporting metadata blocks smaller than a FSB.
+ *
+ * In this case we can have multiple xfs_buf_t on a single page and
+ * need to lock out concurrent xfs_buf_t readers as they only
+ * serialise access to the buffer.
+ *
+ * If the FSB size >= PAGE_CACHE_SIZE case, we have no serialisation
+ * between reads of the page. Hence we can have one thread read the
+ * page and modify it, but then race with another thread that thinks
+ * the page is not up-to-date and hence reads it again.
+ *
+ * The result is that the first modifcation to the page is lost.
+ * This sort of AGF/AGI reading race can happen when unlinking inodes
+ * that require truncation and results in the AGI unlinked list
+ * modifications being lost.
+ */
+ _XBF_PAGE_LOCKED = (1 << 22),
} xfs_buf_flags_t;
typedef enum {
--- linux.orig/fs/xfs/linux-2.6/xfs_buf.c 2008/05/09 04:27:47 1.255
+++ linux/fs/xfs/linux-2.6/xfs_buf.c 2008/05/16 04:28:49 1.256
@@ -386,6 +386,8 @@ _xfs_buf_lookup_pages(
if (unlikely(page == NULL)) {
if (flags & XBF_READ_AHEAD) {
bp->b_page_count = i;
+ for (i = 0; i < bp->b_page_count; i++)
+ unlock_page(bp->b_pages[i]);
return -ENOMEM;
}
@@ -415,17 +417,24 @@ _xfs_buf_lookup_pages(
ASSERT(!PagePrivate(page));
if (!PageUptodate(page)) {
page_count--;
- if (blocksize < PAGE_CACHE_SIZE && !PagePrivate(page)) {
+ if (blocksize >= PAGE_CACHE_SIZE) {
+ if (flags & XBF_READ)
+ bp->b_flags |= _XBF_PAGE_LOCKED;
+ } else if (!PagePrivate(page)) {
if (test_page_region(page, offset, nbytes))
page_count++;
}
}
- unlock_page(page);
bp->b_pages[i] = page;
offset = 0;
}
+ if (!(bp->b_flags & _XBF_PAGE_LOCKED)) {
+ for (i = 0; i < bp->b_page_count; i++)
+ unlock_page(bp->b_pages[i]);
+ }
+
if (page_count == bp->b_page_count)
bp->b_flags |= XBF_DONE;
@@ -746,6 +755,7 @@ xfs_buf_associate_memory(
bp->b_count_desired = len;
bp->b_buffer_length = buflen;
bp->b_flags |= XBF_MAPPED;
+ bp->b_flags &= ~_XBF_PAGE_LOCKED;
return 0;
}
@@ -1093,8 +1103,10 @@ _xfs_buf_ioend(
xfs_buf_t *bp,
int schedule)
{
- if (atomic_dec_and_test(&bp->b_io_remaining) == 1)
+ if (atomic_dec_and_test(&bp->b_io_remaining) == 1) {
+ bp->b_flags &= ~_XBF_PAGE_LOCKED;
xfs_buf_ioend(bp, schedule);
+ }
}
STATIC void
@@ -1125,6 +1137,9 @@ xfs_buf_bio_end_io(
if (--bvec >= bio->bi_io_vec)
prefetchw(&bvec->bv_page->flags);
+
+ if (bp->b_flags & _XBF_PAGE_LOCKED)
+ unlock_page(page);
} while (bvec >= bio->bi_io_vec);
_xfs_buf_ioend(bp, 1);
@@ -1163,7 +1178,8 @@ _xfs_buf_ioapply(
* filesystem block size is not smaller than the page size.
*/
if ((bp->b_buffer_length < PAGE_CACHE_SIZE) &&
- (bp->b_flags & XBF_READ) &&
+ ((bp->b_flags & (XBF_READ|_XBF_PAGE_LOCKED)) ==
+ (XBF_READ|_XBF_PAGE_LOCKED)) &&
(blocksize >= PAGE_CACHE_SIZE)) {
bio = bio_alloc(GFP_NOIO, 1);
Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-9/kernel.spec,v
retrieving revision 1.639
retrieving revision 1.640
diff -u -r1.639 -r1.640
--- kernel.spec 15 May 2008 21:35:05 -0000 1.639
+++ kernel.spec 16 May 2008 21:38:01 -0000 1.640
@@ -644,8 +644,9 @@
# atl2 network driver
Patch2020: linux-2.6-netdev-atl2.patch
-# ext[34] patches
+# filesystem patches
Patch2100: linux-2.6-ext34-xattr-fix.patch
+Patch2101: linux-2.6-xfs-small-buffer-reads.patch
# linux1394 git patches
Patch2200: linux-2.6-firewire-git-update.patch
@@ -1172,8 +1173,9 @@
ApplyPatch linux-2.6-netdev-atl2.patch
-# ext3[34] patches
+# filesystem patches
ApplyPatch linux-2.6-ext34-xattr-fix.patch
+ApplyPatch linux-2.6-xfs-small-buffer-reads.patch
# Nouveau DRM + drm fixes
ApplyPatch linux-2.6-drm-git-mm.patch
@@ -1796,6 +1798,9 @@
%kernel_variant_files -a /%{image_install_path}/xen*-%{KVERREL}.xen -e /etc/ld.so.conf.d/kernelcap-%{KVERREL}.xen.conf %{with_xen} xen
%changelog
+* Fri May 16 2008 Eric Sandeen <esandeen at redhat.com>
+- xfs: Fix memory corruption with small buffer reads (kernel.org #10421)
+
* Thu May 15 2008 Eric Sandeen <esandeen at redhat.com>
- ext3/4: fix uninitialized bs in ext3/4_xattr_set_handle()
More information about the scm-commits
mailing list