linux-toradex.git/fs/nilfs2, branch v2.6.30.7

nilfs2: fix preempt count underflow in nilfs_btnode_prepare_change_key

2009-09-15T17:45:25+00:00

commit b1f1b8ce0a1d71cbc72f7540134d52b79bd8f5ac upstream.

This will fix the following preempt count underflow reported from
users with the title "[NILFS users] segctord problem" (Message-ID:
<949415.6494.qm@web58808.mail.re1.yahoo.com> and Message-ID:
):

 WARNING: at kernel/sched.c:4890 sub_preempt_count+0x95/0xa0()
 Hardware name: HP Compaq 6530b (KR980UT#ABC)
 Modules linked in: bridge stp llc bnep rfcomm l2cap xfs exportfs nilfs2 cowloop loop vboxnetadp vboxnetflt vboxdrv btusb bluetooth uvcvideo videodev v4l1_compat v4l2_compat_ioctl32 arc4 snd_hda_codec_analog ecb iwlagn iwlcore rfkill lib80211 mac80211 snd_hda_intel snd_hda_codec ehci_hcd uhci_hcd usbcore snd_hwdep snd_pcm tg3 cfg80211 psmouse snd_timer joydev libphy ohci1394 snd_page_alloc hp_accel lis3lv02d ieee1394 led_class i915 drm i2c_algo_bit video backlight output i2c_core dm_crypt dm_mod
 Pid: 4197, comm: segctord Not tainted 2.6.30-gentoo-r4-64 #7
 Call Trace:
  [] ? sub_preempt_count+0x95/0xa0
  [] warn_slowpath_common+0x78/0xd0
  [] warn_slowpath_null+0xf/0x20
  [] sub_preempt_count+0x95/0xa0
  [] nilfs_btnode_prepare_change_key+0x11b/0x190 [nilfs2]
  [] nilfs_btree_assign_p+0x19d/0x1e0 [nilfs2]
  [] nilfs_btree_assign+0xbd/0x130 [nilfs2]
  [] nilfs_bmap_assign+0x47/0x70 [nilfs2]
  [] nilfs_segctor_do_construct+0x956/0x20f0 [nilfs2]
  [] ? _spin_unlock_irqrestore+0x12/0x40
  [] ? __up_write+0xe0/0x150
  [] ? up_write+0x9/0x10
  [] ? nilfs_bmap_test_and_clear_dirty+0x43/0x60 [nilfs2]
  [] ? nilfs_mdt_fetch_dirty+0x27/0x60 [nilfs2]
  [] nilfs_segctor_construct+0x8c/0xd0 [nilfs2]
  [] nilfs_segctor_thread+0x15c/0x3a0 [nilfs2]
  [] ? nilfs_construction_timeout+0x0/0x10 [nilfs2]
  [] ? add_timer+0x13/0x20
  [] ? __wake_up_common+0x5a/0x90
  [] ? autoremove_wake_function+0x0/0x40
  [] ? nilfs_segctor_thread+0x0/0x3a0 [nilfs2]
  [] ? nilfs_segctor_thread+0x0/0x3a0 [nilfs2]
  [] kthread+0x56/0x90
  [] child_rip+0xa/0x20
  [] ? kthread+0x0/0x90
  [] ? child_rip+0x0/0x20

This problem was caused due to a missing radix_tree_preload() call in
the retry path of nilfs_btnode_prepare_change_key() function.

Reported-by: Eric A 
Reported-by: Jerome Poulin 
Signed-off-by: Ryusuke Konishi 
Tested-by: Jerome Poulin 
Signed-off-by: Greg Kroah-Hartman

nilfs2: fix oops due to inconsistent state in page with discrete b-tree nodes

2009-08-16T21:18:34+00:00

commit a97778457f22181e8c38c4cd7d7e528378738a98 upstream.

Andrea Gelmini gave me a report that a kernel oops hit on a nilfs
filesystem with a 1KB block size when doing rsync.

This turned out to be caused by an inconsistency of dirty state
between a page and its buffers storing b-tree node blocks.

If the page had multiple buffers split over multiple logs, and if the
logs were written at a time, a dirty flag remained in the page even
every dirty flag in the buffers was cleared.

This will fix the failure by dropping the dirty flag properly for
pages with the discrete multiple b-tree nodes.

Reported-by: Andrea Gelmini 
Signed-off-by: Ryusuke Konishi 
Tested-by: Andrea Gelmini 
Signed-off-by: Greg Kroah-Hartman

nilfs2: fix disorder in cp count on error during deleting checkpoints

2009-07-30T21:39:50+00:00

commit d9a0a345ab7a58a30ec38e5bb7401a28714914d2 upstream.

This fixes a bug that checkpoint count gets wrong on errors when
deleting a series of checkpoints.

The count error is persistent since the checkpoint count is stored on
disk.  Some userland programs refer to the count via ioctl, and this
bugfix is needed to prevent malfunction of such programs.

Signed-off-by: Jiro SEKIBA 
Signed-off-by: Ryusuke Konishi 
Signed-off-by: Greg Kroah-Hartman

nilfs2: fix incorrect KERN_CRIT messages in case of write failures

2009-07-30T21:39:49+00:00

commit 4a52df779700080de4afb0436d9dd9188514a69b upstream.

In case of write-failure retries, the following KERN_CRIT level
messages are mistakenly output by nilfs_dat_commit_start() function:

nilfs_dat_commit_start: vbn = 408463, start = 12506, end = 18446744073709551615, pbn = 530210
nilfs_dat_commit_start: vbn = 408515, start = 12506, end = 18446744073709551615, pbn = 530211
nilfs_dat_commit_start: vbn = 408464, start = 12506, end = 18446744073709551615, pbn = 530212
...

This suppresses these messages.

Signed-off-by: Ryusuke Konishi 
Signed-off-by: Greg Kroah-Hartman

nilfs2: fix hang problem of log writer which occurs after write failures

2009-07-30T21:39:48+00:00

commit 8227b29722fdbac72357aae155d171a5c777670c upstream.

Leandro Lucarella gave me a report that nilfs gets stuck after its
write function fails.

The problem turned out to be caused by bugs which leave writeback flag
on pages.  This fixes the problem by ensuring to clear the writeback
flag in error path.

Reported-by: Leandro Lucarella 
Signed-off-by: Ryusuke Konishi 
Signed-off-by: Greg Kroah-Hartman

nilfs2: remove unlikely directive causing mis-conversion of error code

2009-07-30T21:39:47+00:00

commit 0cfae3d8795f388f9de78adb0171520d19da77e9 upstream.

The following error code handling in nilfs_segctor_write() function
wrongly converted negative error codes to a truth value (i.e. 1):

   err = unlikely(err) ? : res;

which originaly meant to be

   err = err ? : res;

This mis-conversion caused that write or sync functions receive the
unexpected error code.  This fixes the bug by removing the unlikely
directive.

Signed-off-by: Ryusuke Konishi 
Signed-off-by: Greg Kroah-Hartman

nilfs2: fix bh leak in nilfs_cpfile_delete_checkpoints function

2009-05-30T13:07:50+00:00

The nilfs_cpfile_delete_checkpoints() wrongly skips brelse() for the
header block of checkpoint file in case of errors.  This fixes the
leak bug.

Signed-off-by: Ryusuke Konishi

nilfs2: fix memory leak in nilfs_ioctl_clean_segments

2009-05-22T11:49:04+00:00

This fixes a new memory leak problem in garbage collection.  The
problem was brought by the bugfix patch ("nilfs2: fix lock order
reversal in nilfs_clean_segments ioctl").

Thanks to Kentaro Suzuki for finding this problem.

Reported-by: Kentaro Suzuki 
Signed-off-by: Ryusuke Konishi

nilfs2: check size of array structured data exchanged via ioctls

2009-05-11T16:48:54+00:00

Although some ioctls of nilfs2 exchange data in the form of indirectly
referenced array, some of them lack size check on the array elements.

This inserts the missing checks and rejects requests if data of ioctl
does not have a valid format.

We usually don't have to check size of structures that we associated
with ioctl commands because the size is tested implicitly for
identifying ioctl command; the checks this patch adds are for the
cases where the implicit check is not applied.

Signed-off-by: Ryusuke Konishi

nilfs2: fix lock order reversal in nilfs_clean_segments ioctl

2009-05-11T05:54:41+00:00

This is a companion patch to ("nilfs2: fix possible circular locking
for get information ioctls").

This corrects lock order reversal between mm->mmap_sem and
nilfs->ns_segctor_sem in nilfs_clean_segments() which was detected by
lockdep check:

 =======================================================
 [ INFO: possible circular locking dependency detected ]
 2.6.30-rc3-nilfs-00003-g360bdc1 #7
 -------------------------------------------------------
 mmap/5294 is trying to acquire lock:
  (&nilfs->ns_segctor_sem){++++.+}, at: [] nilfs_transaction_begin+0xb6/0x10c [nilfs2]

 but task is already holding lock:
  (&mm->mmap_sem){++++++}, at: [] do_page_fault+0x1d8/0x30a

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -> #1 (&mm->mmap_sem){++++++}:
        [] __lock_acquire+0x1066/0x13b0
        [] lock_acquire+0xba/0xdd
        [] might_fault+0x68/0x88
        [] copy_from_user+0x2a/0x111
        [] nilfs_ioctl_prepare_clean_segments+0x1d/0xf1 [nilfs2]
        [] nilfs_clean_segments+0x6d/0x1b9 [nilfs2]
        [] nilfs_ioctl+0x2ad/0x318 [nilfs2]
        [] vfs_ioctl+0x22/0x69
        [] do_vfs_ioctl+0x460/0x499
        [] sys_ioctl+0x40/0x5a
        [] sysenter_do_call+0x12/0x38
        [] 0xffffffff

 -> #0 (&nilfs->ns_segctor_sem){++++.+}:
        [] __lock_acquire+0xdcc/0x13b0
        [] lock_acquire+0xba/0xdd
        [] down_read+0x2a/0x3e
        [] nilfs_transaction_begin+0xb6/0x10c [nilfs2]
        [] nilfs_page_mkwrite+0xe7/0x154 [nilfs2]
        [] __do_fault+0x165/0x376
        [] handle_mm_fault+0x287/0x5d1
        [] do_page_fault+0x2fb/0x30a
        [] error_code+0x72/0x78
        [] 0xffffffff

where nilfs_clean_segments() holds:

  nilfs->ns_segctor_sem -> copy_from_user()
                             --> page fault -> mm->mmap_sem

And, page fault path may hold:

  page fault -> mm->mmap_sem
         --> nilfs_page_mkwrite() -> nilfs->ns_segctor_sem

Even though nilfs_clean_segments() does not perform write access on
given user pages, it may cause deadlock because nilfs->ns_segctor_sem
is shared per device and mm->mmap_sem can be shared with other tasks.

To avoid this problem, this patch moves all calls of copy_from_user()
outside the nilfs->ns_segctor_sem lock in the ioctl.

Signed-off-by: Ryusuke Konishi