Wed May 20 22:04:54 UTC 2009

Author: cebbert

Update of /cvs/pkgs/rpms/kernel/F-10
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv4515

Modified Files:
      Tag: private-fedora-10-2_6_27
	kernel.spec 
Added Files:
      Tag: private-fedora-10-2_6_27
	ext4.git-1-8657e625a390d09a21970a810f271d74e99b4c8f.patch 
	ext4.git-2-b3239aab20df1446ddfb8d0520076d5fd0d4ecd2.patch 
	ext4.git-3-e9b9a50398f0cc909e5645716c74cc1aecd6699e.patch 
	ext4.git-4-ce54e9c7949d1158512accf23825641a92bd07f9.patch 
	ext4.git-5-e0ee7aa0b15299bc678758a754eec51ee537c53f.patch 
Removed Files:
      Tag: private-fedora-10-2_6_27
	linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch 
	linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch 
	linux-2.6.27-ext4-fix-header-check.patch 
	linux-2.6.27-ext4-print-warning-once.patch 
Log Message:
Merge official ext4 patches headed for -stable.
Drop ext4 patches we already had:
    linux-2.6.27-ext4-fix-header-check.patch
    linux-2.6.27-ext4-print-warning-once.patch
    linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch
    linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch

ext4.git-1-8657e625a390d09a21970a810f271d74e99b4c8f.patch:

--- NEW FILE ext4.git-1-8657e625a390d09a21970a810f271d74e99b4c8f.patch ---
From: Eric Sandeen <sandeen at redhat.com>
Date: Wed, 4 Mar 2009 23:38:18 +0000 (-0500)
Subject: ext4: fix ext4_free_inode() vs. ext4_claim_inode() race
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftytso%2Fext4.git;a=commitdiff_plain;h=8657e625a390d09a21970a810f271d74e99b4c8f

ext4: fix ext4_free_inode() vs. ext4_claim_inode() race

I was seeing fsck errors on inode bitmaps after a 4 thread
dbench run on a 4 cpu machine:

Inode bitmap differences: -50736 -(50752--50753) etc...

I believe that this is because ext4_free_inode() uses atomic
bitops, and although ext4_new_inode() *used* to also use atomic
bitops for synchronization, commit
393418676a7602e1d7d3f6e560159c65c8cbd50e changed this to use
the sb_bgl_lock, so that we could also synchronize against
read_inode_bitmap and initialization of uninit inode tables.

However, that change left ext4_free_inode using atomic bitops,
which I think leaves no synchronization between setting &
unsetting bits in the inode table.

The below patch fixes it for me, although I wonder if we're
getting at all heavy-handed with this spinlock...

Signed-off-by: Eric Sandeen <sandeen at redhat.com>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar at linux.vnet.ibm.com>
Signed-off-by: "Theodore Ts'o" <tytso at mit.edu>
(cherry picked from commit 7ce9d5d1f3c8736511daa413c64985a05b2feee3)
---

diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index cce841f..f9b9fad 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -188,7 +188,7 @@ void ext4_free_inode (handle_t *handle, struct inode * inode)
 	struct ext4_group_desc * gdp;
 	struct ext4_super_block * es;
 	struct ext4_sb_info *sbi;
-	int fatal = 0, err;
+	int fatal = 0, err, cleared;
 	ext4_group_t flex_group;
 
 	if (atomic_read(&inode->i_count) > 1) {
@@ -242,10 +242,12 @@ void ext4_free_inode (handle_t *handle, struct inode * inode)
 		goto error_return;
 
 	/* Ok, now we can actually update the inode bitmaps.. */
-	if (!ext4_clear_bit_atomic(sb_bgl_lock(sbi, block_group),
-					bit, bitmap_bh->b_data))
-		ext4_error (sb, "ext4_free_inode",
-			      "bit already cleared for inode %lu", ino);
+	spin_lock(sb_bgl_lock(sbi, block_group));
+	cleared = ext4_clear_bit(bit, bitmap_bh->b_data);
+	spin_unlock(sb_bgl_lock(sbi, block_group));
+	if (!cleared)
+		ext4_error(sb, "ext4_free_inode",
+			   "bit already cleared for inode %lu", ino);
 	else {
 		gdp = ext4_get_group_desc (sb, block_group, &bh2);
 

ext4.git-2-b3239aab20df1446ddfb8d0520076d5fd0d4ecd2.patch:

--- NEW FILE ext4.git-2-b3239aab20df1446ddfb8d0520076d5fd0d4ecd2.patch ---
From: Eric Sandeen <sandeen at redhat.com>
Date: Tue, 10 Mar 2009 22:18:47 +0000 (-0400)
Subject: ext4: fix header check in ext4_ext_search_right() for deep extent trees.
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftytso%2Fext4.git;a=commitdiff_plain;h=b3239aab20df1446ddfb8d0520076d5fd0d4ecd2

ext4: fix header check in ext4_ext_search_right() for deep extent trees.

The ext4_ext_search_right() function is confusing; it uses a
"depth" variable which is 0 at the root and maximum at the leaves,
but the on-disk metadata uses a "depth" (actually eh_depth) which
is opposite: maximum at the root, and 0 at the leaves.

The ext4_ext_check_header() function is given a depth and checks
the header agaisnt that depth; it expects the on-disk semantics,
but we are giving it the opposite in the while loop in this
function.  We should be giving it the on-disk notion of "depth"
which we can get from (p_depth - depth) - and if you look, the last
(more commonly hit) call to ext4_ext_check_header() does just this.

Sending in the wrong depth results in (incorrect) messages
about corruption:

EXT4-fs error (device sdb1): ext4_ext_search_right: bad header
in inode #2621457: unexpected eh_depth - magic f30a, entries 340,
max 340(0), depth 1(2)

http://bugzilla.kernel.org/show_bug.cgi?id=12821

Reported-by: David Dindorp <ddi at dubex.dk>
Signed-off-by: Eric Sandeen <sandeen at redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso at mit.edu>
(cherry picked from commit 395a87bfefbc400011417e9eaae33169f9f036c0)
---

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index b24d3c5..acb98c9 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -1118,7 +1118,8 @@ ext4_ext_search_right(struct inode *inode, struct ext4_ext_path *path,
 	struct ext4_extent_idx *ix;
 	struct ext4_extent *ex;
 	ext4_fsblk_t block;
-	int depth, ee_len;
+	int depth;	/* Note, NOT eh_depth; depth from top of tree */
+	int ee_len;
 
 	BUG_ON(path == NULL);
 	depth = path->p_depth;
@@ -1177,7 +1178,8 @@ ext4_ext_search_right(struct inode *inode, struct ext4_ext_path *path,
 		if (bh == NULL)
 			return -EIO;
 		eh = ext_block_hdr(bh);
-		if (ext4_ext_check_header(inode, eh, depth)) {
+		/* subtract from p_depth to get proper eh_depth */
+		if (ext4_ext_check_header(inode, eh, path->p_depth - depth)) {
 			put_bh(bh);
 			return -EIO;
 		}

ext4.git-3-e9b9a50398f0cc909e5645716c74cc1aecd6699e.patch:

--- NEW FILE ext4.git-3-e9b9a50398f0cc909e5645716c74cc1aecd6699e.patch ---
From: Theodore Ts'o <tytso at mit.edu>
Date: Thu, 12 Mar 2009 16:20:01 +0000 (-0400)
Subject: ext4: Print the find_group_flex() warning only once
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftytso%2Fext4.git;a=commitdiff_plain;h=e9b9a50398f0cc909e5645716c74cc1aecd6699e

ext4: Print the find_group_flex() warning only once

This is a short-term warning, and even printk_ratelimit() can result
in too much noise in system logs.  So only print it once as a warning.

Signed-off-by: "Theodore Ts'o" <tytso at mit.edu>
(cherry picked from commit 2842c3b5449f31470b61db716f1926b594fb6156)
---

diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index f9b9fad..b9457e1 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -687,6 +687,7 @@ struct inode *ext4_new_inode(handle_t *handle, struct inode * dir, int mode)
 	struct inode *ret;
 	ext4_group_t i;
 	int free = 0;
+	static int once = 1;
 	ext4_group_t flex_group;
 
 	/* Cannot create files in a deleted directory */
@@ -706,7 +707,8 @@ struct inode *ext4_new_inode(handle_t *handle, struct inode * dir, int mode)
 		ret2 = find_group_flex(sb, dir, &group);
 		if (ret2 == -1) {
 			ret2 = find_group_other(sb, dir, &group);
-			if (ret2 == 0 && printk_ratelimit())
+			if (ret2 == 0 && once)
+				once = 0;
 				printk(KERN_NOTICE "ext4: find_group_flex "
 				       "failed, fallback succeeded dir %lu\n",
 				       dir->i_ino);

ext4.git-4-ce54e9c7949d1158512accf23825641a92bd07f9.patch:

--- NEW FILE ext4.git-4-ce54e9c7949d1158512accf23825641a92bd07f9.patch ---
From: Eric Sandeen <sandeen at redhat.com>
Date: Sat, 14 Mar 2009 15:51:46 +0000 (-0400)
Subject: ext4: fix bogus BUG_ONs in in mballoc code
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftytso%2Fext4.git;a=commitdiff_plain;h=ce54e9c7949d1158512accf23825641a92bd07f9

ext4: fix bogus BUG_ONs in in mballoc code

Thiemo Nagel reported that:

# dd if=/dev/zero of=image.ext4 bs=1M count=2
# mkfs.ext4 -v -F -b 1024 -m 0 -g 512 -G 4 -I 128 -N 1 \
  -O large_file,dir_index,flex_bg,extent,sparse_super image.ext4
# mount -o loop image.ext4 mnt/
# dd if=/dev/zero of=mnt/file

oopsed, with a BUG_ON in ext4_mb_normalize_request because
size == EXT4_BLOCKS_PER_GROUP

It appears to me (esp. after talking to Andreas) that the BUG_ON
is bogus; a request of exactly EXT4_BLOCKS_PER_GROUP should
be allowed, though larger sizes do indicate a problem.

Fix that an another (apparently rare) codepath with a similar check.

Reported-by: Thiemo Nagel <thiemo.nagel at ph.tum.de>
Signed-off-by: Eric Sandeen <sandeen at redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso at mit.edu>
(cherry picked from commit 8d03c7a0c550e7ab24cadcef5e66656bfadec8b9)
---

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 39d7cc1..ceb68db 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1450,7 +1450,7 @@ static void ext4_mb_measure_extent(struct ext4_allocation_context *ac,
 	struct ext4_free_extent *gex = &ac->ac_g_ex;
 
 	BUG_ON(ex->fe_len <= 0);
-	BUG_ON(ex->fe_len >= EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
+	BUG_ON(ex->fe_len > EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
 	BUG_ON(ex->fe_start >= EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
 	BUG_ON(ac->ac_status != AC_STATUS_CONTINUE);
 
@@ -3400,7 +3400,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
 	}
 	BUG_ON(start + size <= ac->ac_o_ex.fe_logical &&
 			start > ac->ac_o_ex.fe_logical);
-	BUG_ON(size <= 0 || size >= EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
+	BUG_ON(size <= 0 || size > EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
 
 	/* now prepare goal request */
 

ext4.git-5-e0ee7aa0b15299bc678758a754eec51ee537c53f.patch:

--- NEW FILE ext4.git-5-e0ee7aa0b15299bc678758a754eec51ee537c53f.patch ---
From: Eric Sandeen <sandeen at redhat.com>
Date: Tue, 17 Mar 2009 03:25:40 +0000 (-0400)
Subject: ext4: fix bb_prealloc_list corruption due to wrong group locking
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftytso%2Fext4.git;a=commitdiff_plain;h=e0ee7aa0b15299bc678758a754eec51ee537c53f

ext4: fix bb_prealloc_list corruption due to wrong group locking

This is for Red Hat bug 490026: EXT4 panic, list corruption in
ext4_mb_new_inode_pa

ext4_lock_group(sb, group) is supposed to protect this list for
each group, and a common code flow to remove an album is like
this:

    ext4_get_group_no_and_offset(sb, pa->pa_pstart, &grp, NULL);
    ext4_lock_group(sb, grp);
    list_del(&pa->pa_group_list);
    ext4_unlock_group(sb, grp);

so it's critical that we get the right group number back for
this prealloc context, to lock the right group (the one
associated with this pa) and prevent concurrent list manipulation.

however, ext4_mb_put_pa() passes in (pa->pa_pstart - 1) with a
comment, "-1 is to protect from crossing allocation group".

This makes sense for the group_pa, where pa_pstart is advanced
by the length which has been used (in ext4_mb_release_context()),
and when the entire length has been used, pa_pstart has been
advanced to the first block of the next group.

However, for inode_pa, pa_pstart is never advanced; it's just
set once to the first block in the group and not moved after
that.  So in this case, if we subtract one in ext4_mb_put_pa(),
we are actually locking the *previous* group, and opening the
race with the other threads which do not subtract off the extra
block.

Signed-off-by: Eric Sandeen <sandeen at redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso at mit.edu>
(cherry-picked from commit d33a1976fbee1ee321d6f014333d8f03a39d526c)
---

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index ceb68db..f34dada 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3698,6 +3698,7 @@ static void ext4_mb_put_pa(struct ext4_allocation_context *ac,
 			struct super_block *sb, struct ext4_prealloc_space *pa)
 {
 	unsigned long grp;
+	ext4_fsblk_t grp_blk;
 
 	if (!atomic_dec_and_test(&pa->pa_count) || pa->pa_free != 0)
 		return;
@@ -3712,8 +3713,12 @@ static void ext4_mb_put_pa(struct ext4_allocation_context *ac,
 	pa->pa_deleted = 1;
 	spin_unlock(&pa->pa_lock);
 
-	/* -1 is to protect from crossing allocation group */
-	ext4_get_group_no_and_offset(sb, pa->pa_pstart - 1, &grp, NULL);
+	grp_blk = pa->pa_pstart;
+	/* If linear, pa_pstart may be in the next group when pa is used up */
+	if (pa->pa_linear)
+		grp_blk--;
+
+	ext4_get_group_no_and_offset(sb, grp_blk, &grp, NULL);
 
 	/*
 	 * possible race:


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-10/kernel.spec,v
retrieving revision 1.1206.2.62
retrieving revision 1.1206.2.63
diff -u -p -r1.1206.2.62 -r1.1206.2.63
--- kernel.spec	20 May 2009 21:49:21 -0000	1.1206.2.62
+++ kernel.spec	20 May 2009 22:04:54 -0000	1.1206.2.63
@@ -753,16 +753,13 @@ Patch2807: linux-2.6-pciehp-kill-annoyin
 Patch2900: linux-2.6.27-ext4-rename-ext4dev-to-ext4.patch
 # Delay capable check to avoid most AVCs (#478299)
 Patch2901: linux-2.6.27.9-ext4-cap-check-delay.patch
-# don't spew warnings when using fallback allocator
-Patch2902: linux-2.6.27-ext4-print-warning-once.patch
-# fix extent header checking
-Patch2903: linux-2.6.27-ext4-fix-header-check.patch
-
-# from 2.6.29-rc, 18 mar 2009
-Patch2904: linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch
-Patch2905: linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch
 
 # next round of ext4 patches for -stable
+Patch2910: ext4.git-1-8657e625a390d09a21970a810f271d74e99b4c8f.patch
+Patch2911: ext4.git-2-b3239aab20df1446ddfb8d0520076d5fd0d4ecd2.patch
+Patch2912: ext4.git-3-e9b9a50398f0cc909e5645716c74cc1aecd6699e.patch
+Patch2913: ext4.git-4-ce54e9c7949d1158512accf23825641a92bd07f9.patch
+Patch2914: ext4.git-5-e0ee7aa0b15299bc678758a754eec51ee537c53f.patch
 
 # Add better support for DMI-based autoloading
 Patch3110: linux-2.6-dmi-autoload.patch
@@ -1187,12 +1184,13 @@ ApplyPatch linux-2.6-execshield.patch
 # ext4
 ApplyPatch linux-2.6.27-ext4-rename-ext4dev-to-ext4.patch
 ApplyPatch linux-2.6.27.9-ext4-cap-check-delay.patch
-ApplyPatch linux-2.6.27-ext4-print-warning-once.patch
-ApplyPatch linux-2.6.27-ext4-fix-header-check.patch
 
-# in 2.6.29  18 mar 2009
-ApplyPatch linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch
-ApplyPatch linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch
+# ext4 patches scheduled for -stable
+ApplyPatch ext4.git-1-8657e625a390d09a21970a810f271d74e99b4c8f.patch
+ApplyPatch ext4.git-2-b3239aab20df1446ddfb8d0520076d5fd0d4ecd2.patch
+ApplyPatch ext4.git-3-e9b9a50398f0cc909e5645716c74cc1aecd6699e.patch
+ApplyPatch ext4.git-4-ce54e9c7949d1158512accf23825641a92bd07f9.patch
+ApplyPatch ext4.git-5-e0ee7aa0b15299bc678758a754eec51ee537c53f.patch
 
 # xfs
 
@@ -1981,6 +1979,14 @@ fi
 %kernel_variant_files -k vmlinux %{with_kdump} kdump
 
 %changelog
+* Wed Apr 20 2009 Chuck Ebbert <cebbert at redhat.com>  2.6.27.24-170.2.63
+- Merge official ext4 patches headed for -stable.
+- Drop ext4 patches we already had:
+    linux-2.6.27-ext4-fix-header-check.patch
+    linux-2.6.27-ext4-print-warning-once.patch
+    linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch
+    linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch
+
 * Wed Apr 20 2009 Chuck Ebbert <cebbert at redhat.com>  2.6.27.24-170.2.62
 - Add patches from Fedora 9:
   Update the atl2 network driver to version 2.0.5


--- linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch DELETED ---


--- linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch DELETED ---


--- linux-2.6.27-ext4-fix-header-check.patch DELETED ---


--- linux-2.6.27-ext4-print-warning-once.patch DELETED ---


