rpms/kernel/F-10 linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch, NONE, 1.1.2.1 linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch, NONE, 1.1.2.1 kernel.spec, 1.1206.2.50, 1.1206.2.51

[Chuck Ebbert]

Author: cebbert

Update of /cvs/pkgs/rpms/kernel/F-10
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv28065

Modified Files:
      Tag: private-fedora-10-2_6_27
	kernel.spec 
Added Files:
      Tag: private-fedora-10-2_6_27
	linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch 
	linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch 
Log Message:
Two small ext4 fixes from 2.6.29:
    linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch
    linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch

linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch:

--- NEW FILE linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch ---
From: Eric Sandeen <sandeen at redhat.com>
Date: Tue, 17 Mar 2009 03:25:40 +0000 (-0400)
Subject: ext4: fix bb_prealloc_list corruption due to wrong group locking
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=d33a1976fbee1ee321d6f014333d8f03a39d526c

ext4: fix bb_prealloc_list corruption due to wrong group locking

This is for Red Hat bug 490026: EXT4 panic, list corruption in
ext4_mb_new_inode_pa

ext4_lock_group(sb, group) is supposed to protect this list for
each group, and a common code flow to remove an album is like
this:

    ext4_get_group_no_and_offset(sb, pa->pa_pstart, &grp, NULL);
    ext4_lock_group(sb, grp);
    list_del(&pa->pa_group_list);
    ext4_unlock_group(sb, grp);

so it's critical that we get the right group number back for
this prealloc context, to lock the right group (the one
associated with this pa) and prevent concurrent list manipulation.

however, ext4_mb_put_pa() passes in (pa->pa_pstart - 1) with a
comment, "-1 is to protect from crossing allocation group".

This makes sense for the group_pa, where pa_pstart is advanced
by the length which has been used (in ext4_mb_release_context()),
and when the entire length has been used, pa_pstart has been
advanced to the first block of the next group.

However, for inode_pa, pa_pstart is never advanced; it's just
set once to the first block in the group and not moved after
that.  So in this case, if we subtract one in ext4_mb_put_pa(),
we are actually locking the *previous* group, and opening the
race with the other threads which do not subtract off the extra
block.

Signed-off-by: Eric Sandeen <sandeen at redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso at mit.edu>
---
cebbert: trivial backport

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 41f4348..9f61e62 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3589,6 +3589,7 @@ static void ext4_mb_put_pa(struct ext4_allocation_context *ac,
 			struct super_block *sb, struct ext4_prealloc_space *pa)
 {
 	unsigned long grp;
+	ext4_fsblk_t grp_blk;
 
 	if (!atomic_dec_and_test(&pa->pa_count) || pa->pa_free != 0)
 		return;
@@ -3603,8 +3604,12 @@ static void ext4_mb_put_pa(struct ext4_allocation_context *ac,
 	pa->pa_deleted = 1;
 	spin_unlock(&pa->pa_lock);
 
-	/* -1 is to protect from crossing allocation group */
-	ext4_get_group_no_and_offset(sb, pa->pa_pstart - 1, &grp, NULL);
+	grp_blk = pa->pa_pstart;
+	/* If linear, pa_pstart may be in the next group when pa is used up */
+	if (pa->pa_linear)
+		grp_blk--;
+
+	ext4_get_group_no_and_offset(sb, grp_blk, &grp, NULL);
 
 	/*
 	 * possible race:

linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch:

--- NEW FILE linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch ---
From: Eric Sandeen <sandeen at redhat.com>
Date: Sat, 14 Mar 2009 15:51:46 +0000 (-0400)
Subject: ext4: fix bogus BUG_ONs in in mballoc code
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=8d03c7a0c550e7ab24cadcef5e66656bfadec8b9

ext4: fix bogus BUG_ONs in in mballoc code

Thiemo Nagel reported that:

# dd if=/dev/zero of=image.ext4 bs=1M count=2
# mkfs.ext4 -v -F -b 1024 -m 0 -g 512 -G 4 -I 128 -N 1 \
  -O large_file,dir_index,flex_bg,extent,sparse_super image.ext4
# mount -o loop image.ext4 mnt/
# dd if=/dev/zero of=mnt/file

oopsed, with a BUG_ON in ext4_mb_normalize_request because
size == EXT4_BLOCKS_PER_GROUP

It appears to me (esp. after talking to Andreas) that the BUG_ON
is bogus; a request of exactly EXT4_BLOCKS_PER_GROUP should
be allowed, though larger sizes do indicate a problem.

Fix that an another (apparently rare) codepath with a similar check.

Reported-by: Thiemo Nagel <thiemo.nagel at ph.tum.de>
Signed-off-by: Eric Sandeen <sandeen at redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso at mit.edu>
---

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 4415bee..41f4348 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1447,7 +1447,7 @@ static void ext4_mb_measure_extent(struct ext4_allocation_context *ac,
 	struct ext4_free_extent *gex = &ac->ac_g_ex;
 
 	BUG_ON(ex->fe_len <= 0);
-	BUG_ON(ex->fe_len >= EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
+	BUG_ON(ex->fe_len > EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
 	BUG_ON(ex->fe_start >= EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
 	BUG_ON(ac->ac_status != AC_STATUS_CONTINUE);
 
@@ -3292,7 +3292,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
 	}
 	BUG_ON(start + size <= ac->ac_o_ex.fe_logical &&
 			start > ac->ac_o_ex.fe_logical);
-	BUG_ON(size <= 0 || size >= EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
+	BUG_ON(size <= 0 || size > EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
 
 	/* now prepare goal request */
 


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-10/kernel.spec,v
retrieving revision 1.1206.2.50
retrieving revision 1.1206.2.51
diff -u -r1.1206.2.50 -r1.1206.2.51
--- kernel.spec	17 Mar 2009 19:04:58 -0000	1.1206.2.50
+++ kernel.spec	18 Mar 2009 21:01:25 -0000	1.1206.2.51
@@ -751,6 +751,10 @@
 # fix extent header checking
 Patch2903: linux-2.6.27-ext4-fix-header-check.patch
 
+# from 2.6.29-rc, 18 mar 2009
+Patch2904: linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch
+Patch2905: linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch
+
 # next round of ext4 patches for -stable
 
 # Add better support for DMI-based autoloading
@@ -1177,6 +1181,10 @@
 ApplyPatch linux-2.6.27-ext4-print-warning-once.patch
 ApplyPatch linux-2.6.27-ext4-fix-header-check.patch
 
+# in 2.6.29  18 mar 2009
+ApplyPatch linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch
+ApplyPatch linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch
+
 # xfs
 
 # USB
@@ -1954,6 +1962,11 @@
 %kernel_variant_files -k vmlinux %{with_kdump} kdump
 
 %changelog
+* Wed Mar 18 2009 Chuck Ebbert <cebbert at redhat.com>  2.6.27.20-170.2.51
+- Two small ext4 fixes from 2.6.29:
+    linux-2.6.27-ext4-fix-bb-prealloc-list-corruption.patch
+    linux-2.6.27-ext4-fix-bogus-bug-ons-in-mballoc.patch
+
 * Tue Mar 17 2009 Chuck Ebbert <cebbert at redhat.com>  2.6.27.20-170.2.50
 - 2.6.27.20