linux.git/fs/nilfs2, branch v2.6.30

nilfs2: fix bh leak in nilfs_cpfile_delete_checkpoints function

2009-05-30T13:07:50+00:00

The nilfs_cpfile_delete_checkpoints() wrongly skips brelse() for the
header block of checkpoint file in case of errors.  This fixes the
leak bug.

Signed-off-by: Ryusuke Konishi

nilfs2: fix memory leak in nilfs_ioctl_clean_segments

2009-05-22T11:49:04+00:00

This fixes a new memory leak problem in garbage collection.  The
problem was brought by the bugfix patch ("nilfs2: fix lock order
reversal in nilfs_clean_segments ioctl").

Thanks to Kentaro Suzuki for finding this problem.

Reported-by: Kentaro Suzuki 
Signed-off-by: Ryusuke Konishi

nilfs2: check size of array structured data exchanged via ioctls

2009-05-11T16:48:54+00:00

Although some ioctls of nilfs2 exchange data in the form of indirectly
referenced array, some of them lack size check on the array elements.

This inserts the missing checks and rejects requests if data of ioctl
does not have a valid format.

We usually don't have to check size of structures that we associated
with ioctl commands because the size is tested implicitly for
identifying ioctl command; the checks this patch adds are for the
cases where the implicit check is not applied.

Signed-off-by: Ryusuke Konishi

nilfs2: fix lock order reversal in nilfs_clean_segments ioctl

2009-05-11T05:54:41+00:00

This is a companion patch to ("nilfs2: fix possible circular locking
for get information ioctls").

This corrects lock order reversal between mm->mmap_sem and
nilfs->ns_segctor_sem in nilfs_clean_segments() which was detected by
lockdep check:

 =======================================================
 [ INFO: possible circular locking dependency detected ]
 2.6.30-rc3-nilfs-00003-g360bdc1 #7
 -------------------------------------------------------
 mmap/5294 is trying to acquire lock:
  (&nilfs->ns_segctor_sem){++++.+}, at: [] nilfs_transaction_begin+0xb6/0x10c [nilfs2]

 but task is already holding lock:
  (&mm->mmap_sem){++++++}, at: [] do_page_fault+0x1d8/0x30a

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -> #1 (&mm->mmap_sem){++++++}:
        [] __lock_acquire+0x1066/0x13b0
        [] lock_acquire+0xba/0xdd
        [] might_fault+0x68/0x88
        [] copy_from_user+0x2a/0x111
        [] nilfs_ioctl_prepare_clean_segments+0x1d/0xf1 [nilfs2]
        [] nilfs_clean_segments+0x6d/0x1b9 [nilfs2]
        [] nilfs_ioctl+0x2ad/0x318 [nilfs2]
        [] vfs_ioctl+0x22/0x69
        [] do_vfs_ioctl+0x460/0x499
        [] sys_ioctl+0x40/0x5a
        [] sysenter_do_call+0x12/0x38
        [] 0xffffffff

 -> #0 (&nilfs->ns_segctor_sem){++++.+}:
        [] __lock_acquire+0xdcc/0x13b0
        [] lock_acquire+0xba/0xdd
        [] down_read+0x2a/0x3e
        [] nilfs_transaction_begin+0xb6/0x10c [nilfs2]
        [] nilfs_page_mkwrite+0xe7/0x154 [nilfs2]
        [] __do_fault+0x165/0x376
        [] handle_mm_fault+0x287/0x5d1
        [] do_page_fault+0x2fb/0x30a
        [] error_code+0x72/0x78
        [] 0xffffffff

where nilfs_clean_segments() holds:

  nilfs->ns_segctor_sem -> copy_from_user()
                             --> page fault -> mm->mmap_sem

And, page fault path may hold:

  page fault -> mm->mmap_sem
         --> nilfs_page_mkwrite() -> nilfs->ns_segctor_sem

Even though nilfs_clean_segments() does not perform write access on
given user pages, it may cause deadlock because nilfs->ns_segctor_sem
is shared per device and mm->mmap_sem can be shared with other tasks.

To avoid this problem, this patch moves all calls of copy_from_user()
outside the nilfs->ns_segctor_sem lock in the ioctl.

Signed-off-by: Ryusuke Konishi

nilfs2: fix possible circular locking for get information ioctls

2009-05-11T03:57:46+00:00

This is one of two patches which are to correct possible circular
locking between mm->mmap_sem and nilfs->ns_segctor_sem.

The problem was detected by lockdep check as follows:

 =======================================================
 [ INFO: possible circular locking dependency detected ]
 2.6.30-rc3-nilfs-00002-g3552613 #6
 -------------------------------------------------------
 mmap/5418 is trying to acquire lock:
 (&nilfs->ns_segctor_sem){++++.+}, at: [] nilfs_transaction_begin+0xb6/0x10c [nilfs2]

 but task is already holding lock:
 (&mm->mmap_sem){++++++}, at: [] do_page_fault+0x1d8/0x30a

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -> #1 (&mm->mmap_sem){++++++}:
 [] __lock_acquire+0x1066/0x13b0
 [] lock_acquire+0xba/0xdd
 [] might_fault+0x68/0x88
 [] copy_to_user+0x2c/0xfc
 [] nilfs_ioctl_wrap_copy+0x103/0x160 [nilfs2]
 [] nilfs_ioctl+0x30a/0x3b0 [nilfs2]
 [] vfs_ioctl+0x22/0x69
 [] do_vfs_ioctl+0x460/0x499
 [] sys_ioctl+0x40/0x5a
 [] sysenter_do_call+0x12/0x38
 [] 0xffffffff

 -> #0 (&nilfs->ns_segctor_sem){++++.+}:
 [] __lock_acquire+0xdcc/0x13b0
 [] lock_acquire+0xba/0xdd
 [] down_read+0x2a/0x3e
 [] nilfs_transaction_begin+0xb6/0x10c [nilfs2]
 [] nilfs_page_mkwrite+0xe7/0x154 [nilfs2]
 [] __do_fault+0x165/0x376
 [] handle_mm_fault+0x287/0x5d1
 [] do_page_fault+0x2fb/0x30a
 [] error_code+0x72/0x78
 [] 0xffffffff

 other info that might help us debug this:

 1 lock held by mmap/5418:
 #0:  (&mm->mmap_sem){++++++}, at: [] do_page_fault+0x1d8/0x30a

 stack backtrace:
 Pid: 5418, comm: mmap Not tainted 2.6.30-rc3-nilfs-00002-g3552613 #6
 Call Trace:
 [] ? printk+0xf/0x12
 [] print_circular_bug_tail+0xaa/0xb5
 [] __lock_acquire+0xdcc/0x13b0
 [] ? nilfs_sufile_get_stat+0x1e/0x105 [nilfs2]
 [] ? up_read+0x16/0x2c
 [] ? nilfs_sufile_get_stat+0xfa/0x105 [nilfs2]
 [] lock_acquire+0xba/0xdd
 [] ? nilfs_transaction_begin+0xb6/0x10c [nilfs2]
 [] down_read+0x2a/0x3e
 [] ? nilfs_transaction_begin+0xb6/0x10c [nilfs2]
 [] nilfs_transaction_begin+0xb6/0x10c [nilfs2]
 [] nilfs_page_mkwrite+0xe7/0x154 [nilfs2]
 [] __do_fault+0x165/0x376
 [] handle_mm_fault+0x287/0x5d1
 [] ? do_page_fault+0x1d8/0x30a
 [] ? down_read_trylock+0x39/0x43
 [] do_page_fault+0x2fb/0x30a
 [] ? do_page_fault+0x0/0x30a
 [] error_code+0x72/0x78
 [] ? do_page_fault+0x0/0x30a

This makes the lock granularity of nilfs->ns_segctor_sem finer than
that of the mmap semaphore for ioctl commands except
nilfs_clean_segments().

The successive patch ("nilfs2: fix lock order reversal in
nilfs_clean_segments ioctl") is required to fully resolve the problem.

Signed-off-by: Ryusuke Konishi

nilfs2: ensure to clear dirty state when deleting metadata file block

2009-05-10T08:04:42+00:00

This would fix the following failure during GC:

 nilfs_cpfile_delete_checkpoints: cannot delete block
 NILFS: GC failed during preparation: cannot delete checkpoints: err=-2

The problem was caused by a break in state consistency between page
cache and btree; the above block was removed from the btree but the
page buffering the block was remaining in the page cache in dirty
state.

This resolves the inconsistency by ensuring to clear dirty state of
the page buffering the deleted block.

Reported-by: David Arendt 
Signed-off-by: Ryusuke Konishi

nilfs2: fix circular locking dependency of writer mutex

2009-05-09T04:36:57+00:00

This fixes the following circular locking dependency problem:

 =======================================================
 [ INFO: possible circular locking dependency detected ]
 2.6.30-rc3 #5
 -------------------------------------------------------
 segctord/3895 is trying to acquire lock:
  (&nilfs->ns_writer_mutex){+.+...}, at: []
   nilfs_mdt_get_block+0x89/0x20f [nilfs2]

 but task is already holding lock:
  (&bmap->b_sem){++++..}, at: []
   nilfs_bmap_propagate+0x14/0x2e [nilfs2]

 which lock already depends on the new lock.

The bugfix is done by replacing call sites of nilfs_get_writer() which
are never called from read-only context with direct dereferencing of
pointer to a writable FS-instance.

Signed-off-by: Ryusuke Konishi

nilfs2: fix possible recovery failure due to block creation without writer

2009-05-09T04:36:56+00:00

Some function calls in nilfs_prepare_segment_for_recovery() may fail
because they can create blocks on meta data files without configuring
a writable FS-instance.  Concretely, nilfs_mdt_create_block() routine
of meta data files will fail in that case.

This fixes the problem by temporarily attaching a writable FS-instace
during the function is called.

Signed-off-by: Ryusuke Konishi

nilfs2: fix possible mismatch of sufile counters on recovery

2009-04-13T00:53:52+00:00

On-disk counters ndirtysegs and ncleansegs of sufile, can go wrong
after roll-forward recovery because
nilfs_prepare_segment_for_recovery() function marks segments dirty
without adjusting value of these counters.

This fixes the problem by adding a function to sufile which does the
operation adjusting the counters, and by letting the recovery function
use it.

Signed-off-by: Ryusuke Konishi

nilfs2: segment usage file cleanups

2009-04-13T00:53:51+00:00

This will simplify sufile.c by sharing common code which repeatedly
appears in routines updating a segment usage entry; a wrapper function
nilfs_sufile_update() is introduced for the purpose, and counter
modifications are integrated to a new function
nilfs_sufile_mod_counter().

This is a preparation for the successive bugfix patch ("nilfs2: fix
possible mismatch of sufile counters on recovery").

Signed-off-by: Ryusuke Konishi