From ffda9d302267dbb7fc9bc38f6e4c1b3d61a536a9 Mon Sep 17 00:00:00 2001 From: Nick Piggin Date: Tue, 20 Feb 2007 13:57:54 -0800 Subject: [PATCH] fs: fix __block_write_full_page error case buffer submission Andrew noticed that unlocking the page before submitting all buffers for writeout could cause problems if the IO completes before we've finished messing around with the page buffers, and they subsequently get freed. Even if there were no bug, it is a good idea to bring the error case into line with the common case here. Signed-off-by: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- fs/buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'fs/buffer.c') diff --git a/fs/buffer.c b/fs/buffer.c index f99c509697cd..e95fe4f8d11a 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -1743,7 +1743,6 @@ recover: SetPageError(page); BUG_ON(PageWriteback(page)); set_page_writeback(page); - unlock_page(page); do { struct buffer_head *next = bh->b_this_page; if (buffer_async_write(bh)) { @@ -1753,6 +1752,7 @@ recover: } bh = next; } while (bh != head); + unlock_page(page); goto done; } -- cgit From 22c8ca78f20724676b6006232bf06cc3e9299539 Mon Sep 17 00:00:00 2001 From: Nick Piggin Date: Tue, 20 Feb 2007 13:58:09 -0800 Subject: [PATCH] fs: fix nobh data leak nobh_prepare_write leaks data similarly to how simple_prepare_write did. Fix by not marking the page uptodate until nobh_commit_write time. Again, this could break weird use-cases, but none appear to exist in the tree. We can safely remove the set_page_dirty, because as the comment says, nobh_commit_write does set_page_dirty. If a filesystem wants to allocate backing store for a page dirtied via mmap, page_mkwrite is the suggested approach. Signed-off-by: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- fs/buffer.c | 21 +++------------------ 1 file changed, 3 insertions(+), 18 deletions(-) (limited to 'fs/buffer.c') diff --git a/fs/buffer.c b/fs/buffer.c index e95fe4f8d11a..e8504b65176c 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2248,7 +2248,6 @@ int nobh_prepare_write(struct page *page, unsigned from, unsigned to, int i; int ret = 0; int is_mapped_to_disk = 1; - int dirtied_it = 0; if (PageMappedToDisk(page)) return 0; @@ -2285,14 +2284,10 @@ int nobh_prepare_write(struct page *page, unsigned from, unsigned to, continue; if (buffer_new(&map_bh) || !buffer_mapped(&map_bh)) { kaddr = kmap_atomic(page, KM_USER0); - if (block_start < from) { + if (block_start < from) memset(kaddr+block_start, 0, from-block_start); - dirtied_it = 1; - } - if (block_end > to) { + if (block_end > to) memset(kaddr + to, 0, block_end - to); - dirtied_it = 1; - } flush_dcache_page(page); kunmap_atomic(kaddr, KM_USER0); continue; @@ -2347,17 +2342,6 @@ int nobh_prepare_write(struct page *page, unsigned from, unsigned to, if (is_mapped_to_disk) SetPageMappedToDisk(page); - SetPageUptodate(page); - - /* - * Setting the page dirty here isn't necessary for the prepare_write - * function - commit_write will do that. But if/when this function is - * used within the pagefault handler to ensure that all mmapped pages - * have backing space in the filesystem, we will need to dirty the page - * if its contents were altered. - */ - if (dirtied_it) - set_page_dirty(page); return 0; @@ -2387,6 +2371,7 @@ int nobh_commit_write(struct file *file, struct page *page, struct inode *inode = page->mapping->host; loff_t pos = ((loff_t)page->index << PAGE_CACHE_SHIFT) + to; + SetPageUptodate(page); set_page_dirty(page); if (pos > inode->i_size) { i_size_write(inode, pos); -- cgit From 57bf63d69cb6b7064e6fec5e83da4e1918168282 Mon Sep 17 00:00:00 2001 From: Dave Kleikamp Date: Tue, 6 Mar 2007 01:42:12 -0800 Subject: [PATCH] fs: nobh_truncate_page() fix This fixes a regression caused by 22c8ca78f20724676b6006232bf06cc3e9299539. nobh_prepare_write() no longer marks the page uptodate, so nobh_truncate_page() needs to do it. Signed-off-by: Dave Kleikamp Cc: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- fs/buffer.c | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'fs/buffer.c') diff --git a/fs/buffer.c b/fs/buffer.c index e8504b65176c..1d0852fa728b 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2365,6 +2365,10 @@ failed: } EXPORT_SYMBOL(nobh_prepare_write); +/* + * Make sure any changes to nobh_commit_write() are reflected in + * nobh_truncate_page(), since it doesn't call commit_write(). + */ int nobh_commit_write(struct file *file, struct page *page, unsigned from, unsigned to) { @@ -2466,6 +2470,11 @@ int nobh_truncate_page(struct address_space *mapping, loff_t from) memset(kaddr + offset, 0, PAGE_CACHE_SIZE - offset); flush_dcache_page(page); kunmap_atomic(kaddr, KM_USER0); + /* + * It would be more correct to call aops->commit_write() + * here, but this is more efficient. + */ + SetPageUptodate(page); set_page_dirty(page); } unlock_page(page); -- cgit