[RH7,1/3] jbd2: clear dirty flag when revoking a buffer from an older transaction

Submitted by Pavel Tikhomirov on Aug. 22, 2019, 9:47 a.m.


Message ID 20190822094739.17556-2-ptikhomirov@virtuozzo.com
State New
Series "ext4/jbd2: port data corruption fixes from ms"
Headers show

Commit Message

Pavel Tikhomirov Aug. 22, 2019, 9:47 a.m.
From: "zhangyi (F)" <yi.zhang@huawei.com>

Now, we capture a data corruption problem on ext4 while we're truncating
an extent index block. Imaging that if we are revoking a buffer which
has been journaled by the committing transaction, the buffer's jbddirty
flag will not be cleared in jbd2_journal_forget(), so the commit code
will set the buffer dirty flag again after refile the buffer.

fsx                               kjournald2
jbd2_journal_revoke                commit phase 1~5...
   belongs to older transaction    commit phase 6
   jbddirty not clear               __jbd2_journal_refile_buffer

Finally, if the freed extent index block was allocated again as data
block by some other files, it may corrupt the file data after writing
cached pages later, such as during unmount time. (In general,
clean_bdev_aliases() related helpers should be invoked after
re-allocation to prevent the above corruption, but unfortunately we
missed it when zeroout the head of extra extent blocks in

This patch mark buffer as freed and set j_next_transaction to the new
transaction when it already belongs to the committing transaction in
jbd2_journal_forget(), so that commit code knows it should clear dirty
bits when it is done with the buffer.

This problem can be reproduced by xfstests generic/455 easily with
seeds (3246 3247 3248 3249).


Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: stable@vger.kernel.org
(cherry picked from commit 904cdbd41d749a476863a0ca41f6f396774f26e4)
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
 fs/jbd2/transaction.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

Patch hide | download patch | download mbox

diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 9082eae76518..c182906a8bc4 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1494,14 +1494,21 @@  int jbd2_journal_forget (handle_t *handle, struct buffer_head *bh)
 		/* However, if the buffer is still owned by a prior
 		 * (committing) transaction, we can't drop it yet... */
 		JBUFFER_TRACE(jh, "belongs to older transaction");
-		/* ... but we CAN drop it from the new transaction if we
-		 * have also modified it since the original commit. */
+		/* ... but we CAN drop it from the new transaction through
+		 * marking the buffer as freed and set j_next_transaction to
+		 * the new transaction, so that not only the commit code
+		 * knows it should clear dirty bits when it is done with the
+		 * buffer, but also the buffer can be checkpointed only
+		 * after the new transaction commits. */
-		if (jh->b_next_transaction) {
-			J_ASSERT(jh->b_next_transaction == transaction);
+		set_buffer_freed(bh);
+		if (!jh->b_next_transaction) {
-			jh->b_next_transaction = NULL;
+			jh->b_next_transaction = transaction;
+		} else {
+			J_ASSERT(jh->b_next_transaction == transaction);
 			 * only drop a reference if this transaction modified