Commit 56d7acc792c0d98f38f22058671ee715ff197023
Committed by
Linus Torvalds
1 parent
f13a568e5a
Exists in
ti-lsk-linux-4.1.y
and in
10 other branches
nilfs2: fix data loss with mmap()
This bug leads to reproducible silent data loss, despite the use of msync(), sync() and a clean unmount of the file system. It is easily reproducible with the following script: ----------------[BEGIN SCRIPT]-------------------- mkfs.nilfs2 -f /dev/sdb mount /dev/sdb /mnt dd if=/dev/zero bs=1M count=30 of=/mnt/testfile umount /mnt mount /dev/sdb /mnt CHECKSUM_BEFORE="$(md5sum /mnt/testfile)" /root/mmaptest/mmaptest /mnt/testfile 30 10 5 sync CHECKSUM_AFTER="$(md5sum /mnt/testfile)" umount /mnt mount /dev/sdb /mnt CHECKSUM_AFTER_REMOUNT="$(md5sum /mnt/testfile)" umount /mnt echo "BEFORE MMAP:\t$CHECKSUM_BEFORE" echo "AFTER MMAP:\t$CHECKSUM_AFTER" echo "AFTER REMOUNT:\t$CHECKSUM_AFTER_REMOUNT" ----------------[END SCRIPT]-------------------- The mmaptest tool looks something like this (very simplified, with error checking removed): ----------------[BEGIN mmaptest]-------------------- data = mmap(NULL, file_size - file_offset, PROT_READ | PROT_WRITE, MAP_SHARED, fd, file_offset); for (i = 0; i < write_count; ++i) { memcpy(data + i * 4096, buf, sizeof(buf)); msync(data, file_size - file_offset, MS_SYNC)) } ----------------[END mmaptest]-------------------- The output of the script looks something like this: BEFORE MMAP: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile AFTER MMAP: 6604a1c31f10780331a6850371b3a313 /mnt/testfile AFTER REMOUNT: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile So it is clear, that the changes done using mmap() do not survive a remount. This can be reproduced a 100% of the time. The problem was introduced in commit 136e8770cd5d ("nilfs2: fix issue of nilfs_set_page_dirty() for page at EOF boundary"). If the page was read with mpage_readpage() or mpage_readpages() for example, then it has no buffers attached to it. In that case page_has_buffers(page) in nilfs_set_page_dirty() will be false. Therefore nilfs_set_file_dirty() is never called and the pages are never collected and never written to disk. This patch fixes the problem by also calling nilfs_set_file_dirty() if the page has no buffers attached to it. [akpm@linux-foundation.org: s/PAGE_SHIFT/PAGE_CACHE_SHIFT/] Signed-off-by: Andreas Rohner <andreas.rohner@gmx.net> Tested-by: Andreas Rohner <andreas.rohner@gmx.net> Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Showing 1 changed file with 6 additions and 1 deletions Side-by-side Diff
fs/nilfs2/inode.c
... | ... | @@ -24,6 +24,7 @@ |
24 | 24 | #include <linux/buffer_head.h> |
25 | 25 | #include <linux/gfp.h> |
26 | 26 | #include <linux/mpage.h> |
27 | +#include <linux/pagemap.h> | |
27 | 28 | #include <linux/writeback.h> |
28 | 29 | #include <linux/aio.h> |
29 | 30 | #include "nilfs.h" |
30 | 31 | |
... | ... | @@ -219,10 +220,10 @@ |
219 | 220 | |
220 | 221 | static int nilfs_set_page_dirty(struct page *page) |
221 | 222 | { |
223 | + struct inode *inode = page->mapping->host; | |
222 | 224 | int ret = __set_page_dirty_nobuffers(page); |
223 | 225 | |
224 | 226 | if (page_has_buffers(page)) { |
225 | - struct inode *inode = page->mapping->host; | |
226 | 227 | unsigned nr_dirty = 0; |
227 | 228 | struct buffer_head *bh, *head; |
228 | 229 | |
... | ... | @@ -245,6 +246,10 @@ |
245 | 246 | |
246 | 247 | if (nr_dirty) |
247 | 248 | nilfs_set_file_dirty(inode, nr_dirty); |
249 | + } else if (ret) { | |
250 | + unsigned nr_dirty = 1 << (PAGE_CACHE_SHIFT - inode->i_blkbits); | |
251 | + | |
252 | + nilfs_set_file_dirty(inode, nr_dirty); | |
248 | 253 | } |
249 | 254 | return ret; |
250 | 255 | } |
-
mentioned in commit 550a73
-
mentioned in commit 550a73
-
mentioned in commit 550a73
-
mentioned in commit 550a73
-
mentioned in commit 550a73