]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - fs/ext4/page-io.c
ext4: fix unwritten counter leakage
[mirror_ubuntu-bionic-kernel.git] / fs / ext4 / page-io.c
CommitLineData
bd2d0210
TT
1/*
2 * linux/fs/ext4/page-io.c
3 *
4 * This contains the new page_io functions for ext4
5 *
6 * Written by Theodore Ts'o, 2010.
7 */
8
bd2d0210
TT
9#include <linux/fs.h>
10#include <linux/time.h>
11#include <linux/jbd2.h>
12#include <linux/highuid.h>
13#include <linux/pagemap.h>
14#include <linux/quotaops.h>
15#include <linux/string.h>
16#include <linux/buffer_head.h>
17#include <linux/writeback.h>
18#include <linux/pagevec.h>
19#include <linux/mpage.h>
20#include <linux/namei.h>
21#include <linux/uio.h>
22#include <linux/bio.h>
23#include <linux/workqueue.h>
24#include <linux/kernel.h>
25#include <linux/slab.h>
26
27#include "ext4_jbd2.h"
28#include "xattr.h"
29#include "acl.h"
30#include "ext4_extents.h"
31
32static struct kmem_cache *io_page_cachep, *io_end_cachep;
33
5dabfc78 34int __init ext4_init_pageio(void)
bd2d0210
TT
35{
36 io_page_cachep = KMEM_CACHE(ext4_io_page, SLAB_RECLAIM_ACCOUNT);
37 if (io_page_cachep == NULL)
38 return -ENOMEM;
39 io_end_cachep = KMEM_CACHE(ext4_io_end, SLAB_RECLAIM_ACCOUNT);
13195184 40 if (io_end_cachep == NULL) {
bd2d0210
TT
41 kmem_cache_destroy(io_page_cachep);
42 return -ENOMEM;
43 }
bd2d0210
TT
44 return 0;
45}
46
5dabfc78 47void ext4_exit_pageio(void)
bd2d0210
TT
48{
49 kmem_cache_destroy(io_end_cachep);
50 kmem_cache_destroy(io_page_cachep);
51}
52
f7ad6d2e
TT
53void ext4_ioend_wait(struct inode *inode)
54{
e9e3bcec 55 wait_queue_head_t *wq = ext4_ioend_wq(inode);
f7ad6d2e
TT
56
57 wait_event(*wq, (atomic_read(&EXT4_I(inode)->i_ioend_count) == 0));
58}
59
83668e71
TT
60static void put_io_page(struct ext4_io_page *io_page)
61{
62 if (atomic_dec_and_test(&io_page->p_count)) {
6268b325 63 end_page_writeback(io_page->p_page);
83668e71
TT
64 put_page(io_page->p_page);
65 kmem_cache_free(io_page_cachep, io_page);
66 }
67}
68
bd2d0210
TT
69void ext4_free_io_end(ext4_io_end_t *io)
70{
71 int i;
72
73 BUG_ON(!io);
82e54229
DM
74 BUG_ON(io->flag & EXT4_IO_END_UNWRITTEN);
75
bd2d0210
TT
76 if (io->page)
77 put_page(io->page);
83668e71
TT
78 for (i = 0; i < io->num_io_pages; i++)
79 put_io_page(io->pages[i]);
bd2d0210 80 io->num_io_pages = 0;
4e298021
TT
81 if (atomic_dec_and_test(&EXT4_I(io->inode)->i_ioend_count))
82 wake_up_all(ext4_ioend_wq(io->inode));
bd2d0210
TT
83 kmem_cache_free(io_end_cachep, io);
84}
85
86/*
87 * check a range of space and convert unwritten extents to written.
d73d5046
TM
88 *
89 * Called with inode->i_mutex; we depend on this when we manipulate
90 * io->flag, since we could otherwise race with ext4_flush_completed_IO()
bd2d0210
TT
91 */
92int ext4_end_io_nolock(ext4_io_end_t *io)
93{
94 struct inode *inode = io->inode;
95 loff_t offset = io->offset;
96 ssize_t size = io->size;
97 int ret = 0;
98
82e54229
DM
99 BUG_ON(!(io->flag & EXT4_IO_END_UNWRITTEN));
100
bd2d0210
TT
101 ext4_debug("ext4_end_io_nolock: io 0x%p from inode %lu,list->next 0x%p,"
102 "list->prev 0x%p\n",
103 io, inode->i_ino, io->list.next, io->list.prev);
104
bd2d0210
TT
105 ret = ext4_convert_unwritten_extents(inode, offset, size);
106 if (ret < 0) {
b82e384c
TT
107 ext4_msg(inode->i_sb, KERN_EMERG,
108 "failed to convert unwritten extents to written "
109 "extents -- potential data loss! "
110 "(inode %lu, offset %llu, size %zd, error %d)",
111 inode->i_ino, offset, size, ret);
bd2d0210 112 }
82e54229 113 io->flag &= ~EXT4_IO_END_UNWRITTEN;
bd2d0210
TT
114 if (io->iocb)
115 aio_complete(io->iocb, io->result, 0);
e9e3bcec 116
266991b1
JM
117 if (io->flag & EXT4_IO_END_DIRECT)
118 inode_dio_done(inode);
b82e384c 119 /* Wake up anyone waiting on unwritten extent conversion */
e27f41e1 120 if (atomic_dec_and_test(&EXT4_I(inode)->i_unwritten))
b82e384c 121 wake_up_all(ext4_ioend_wq(io->inode));
bd2d0210
TT
122 return ret;
123}
124
125/*
126 * work on completed aio dio IO, to convert unwritten extents to extents
127 */
128static void ext4_end_io_work(struct work_struct *work)
129{
130 ext4_io_end_t *io = container_of(work, ext4_io_end_t, work);
131 struct inode *inode = io->inode;
132 struct ext4_inode_info *ei = EXT4_I(inode);
133 unsigned long flags;
bd2d0210 134
d73d5046 135 spin_lock_irqsave(&ei->i_completed_io_lock, flags);
491caa43
JM
136 if (io->flag & EXT4_IO_END_IN_FSYNC)
137 goto requeue;
d73d5046
TM
138 if (list_empty(&io->list)) {
139 spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
140 goto free;
141 }
d73d5046 142
8c0bec21 143 if (!mutex_trylock(&inode->i_mutex)) {
491caa43
JM
144 bool was_queued;
145requeue:
146 was_queued = !!(io->flag & EXT4_IO_END_QUEUED);
147 io->flag |= EXT4_IO_END_QUEUED;
b82e384c 148 spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
8c0bec21
JZ
149 /*
150 * Requeue the work instead of waiting so that the work
151 * items queued after this can be processed.
152 */
153 queue_work(EXT4_SB(inode->i_sb)->dio_unwritten_wq, &io->work);
154 /*
155 * To prevent the ext4-dio-unwritten thread from keeping
156 * requeueing end_io requests and occupying cpu for too long,
157 * yield the cpu if it sees an end_io request that has already
158 * been requeued.
159 */
491caa43 160 if (was_queued)
8c0bec21 161 yield();
8c0bec21
JZ
162 return;
163 }
b82e384c 164 list_del_init(&io->list);
bd2d0210 165 spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
b82e384c 166 (void) ext4_end_io_nolock(io);
bd2d0210 167 mutex_unlock(&inode->i_mutex);
d73d5046 168free:
bd2d0210
TT
169 ext4_free_io_end(io);
170}
171
172ext4_io_end_t *ext4_init_io_end(struct inode *inode, gfp_t flags)
173{
b17b35ec 174 ext4_io_end_t *io = kmem_cache_zalloc(io_end_cachep, flags);
bd2d0210 175 if (io) {
f7ad6d2e
TT
176 atomic_inc(&EXT4_I(inode)->i_ioend_count);
177 io->inode = inode;
bd2d0210
TT
178 INIT_WORK(&io->work, ext4_end_io_work);
179 INIT_LIST_HEAD(&io->list);
180 }
181 return io;
182}
183
184/*
185 * Print an buffer I/O error compatible with the fs/buffer.c. This
186 * provides compatibility with dmesg scrapers that look for a specific
187 * buffer I/O error message. We really need a unified error reporting
188 * structure to userspace ala Digital Unix's uerf system, but it's
189 * probably not going to happen in my lifetime, due to LKML politics...
190 */
191static void buffer_io_error(struct buffer_head *bh)
192{
193 char b[BDEVNAME_SIZE];
194 printk(KERN_ERR "Buffer I/O error on device %s, logical block %llu\n",
195 bdevname(bh->b_bdev, b),
196 (unsigned long long)bh->b_blocknr);
197}
198
199static void ext4_end_bio(struct bio *bio, int error)
200{
201 ext4_io_end_t *io_end = bio->bi_private;
202 struct workqueue_struct *wq;
203 struct inode *inode;
204 unsigned long flags;
bd2d0210 205 int i;
d50bdd5a 206 sector_t bi_sector = bio->bi_sector;
bd2d0210
TT
207
208 BUG_ON(!io_end);
bd2d0210
TT
209 bio->bi_private = NULL;
210 bio->bi_end_io = NULL;
211 if (test_bit(BIO_UPTODATE, &bio->bi_flags))
212 error = 0;
bd2d0210
TT
213 bio_put(bio);
214
bd2d0210
TT
215 for (i = 0; i < io_end->num_io_pages; i++) {
216 struct page *page = io_end->pages[i]->p_page;
217 struct buffer_head *bh, *head;
39db00f1
CW
218 loff_t offset;
219 loff_t io_end_offset;
bd2d0210 220
39db00f1 221 if (error) {
bd2d0210 222 SetPageError(page);
39db00f1
CW
223 set_bit(AS_EIO, &page->mapping->flags);
224 head = page_buffers(page);
225 BUG_ON(!head);
226
227 io_end_offset = io_end->offset + io_end->size;
bd2d0210
TT
228
229 offset = (sector_t) page->index << PAGE_CACHE_SHIFT;
230 bh = head;
231 do {
232 if ((offset >= io_end->offset) &&
39db00f1
CW
233 (offset+bh->b_size <= io_end_offset))
234 buffer_io_error(bh);
235
bd2d0210
TT
236 offset += bh->b_size;
237 bh = bh->b_this_page;
238 } while (bh != head);
239 }
240
6268b325 241 put_io_page(io_end->pages[i]);
bd2d0210 242 }
6268b325 243 io_end->num_io_pages = 0;
f7ad6d2e
TT
244 inode = io_end->inode;
245
246 if (error) {
247 io_end->flag |= EXT4_IO_END_ERROR;
248 ext4_warning(inode->i_sb, "I/O error writing to inode %lu "
249 "(offset %llu size %ld starting block %llu)",
250 inode->i_ino,
251 (unsigned long long) io_end->offset,
252 (long) io_end->size,
253 (unsigned long long)
d50bdd5a 254 bi_sector >> (inode->i_blkbits - 9));
f7ad6d2e 255 }
bd2d0210 256
b6168443
TT
257 if (!(io_end->flag & EXT4_IO_END_UNWRITTEN)) {
258 ext4_free_io_end(io_end);
259 return;
260 }
261
bd2d0210
TT
262 /* Add the io_end to per-inode completed io list*/
263 spin_lock_irqsave(&EXT4_I(inode)->i_completed_io_lock, flags);
264 list_add_tail(&io_end->list, &EXT4_I(inode)->i_completed_io_list);
265 spin_unlock_irqrestore(&EXT4_I(inode)->i_completed_io_lock, flags);
266
267 wq = EXT4_SB(inode->i_sb)->dio_unwritten_wq;
268 /* queue the work to convert unwritten extents to written */
269 queue_work(wq, &io_end->work);
270}
271
272void ext4_io_submit(struct ext4_io_submit *io)
273{
274 struct bio *bio = io->io_bio;
275
276 if (bio) {
277 bio_get(io->io_bio);
278 submit_bio(io->io_op, io->io_bio);
279 BUG_ON(bio_flagged(io->io_bio, BIO_EOPNOTSUPP));
280 bio_put(io->io_bio);
281 }
7dc57615 282 io->io_bio = NULL;
bd2d0210 283 io->io_op = 0;
7dc57615 284 io->io_end = NULL;
bd2d0210
TT
285}
286
287static int io_submit_init(struct ext4_io_submit *io,
288 struct inode *inode,
289 struct writeback_control *wbc,
290 struct buffer_head *bh)
291{
292 ext4_io_end_t *io_end;
293 struct page *page = bh->b_page;
294 int nvecs = bio_get_nr_vecs(bh->b_bdev);
295 struct bio *bio;
296
297 io_end = ext4_init_io_end(inode, GFP_NOFS);
298 if (!io_end)
299 return -ENOMEM;
275d3ba6 300 bio = bio_alloc(GFP_NOIO, min(nvecs, BIO_MAX_PAGES));
bd2d0210
TT
301 bio->bi_sector = bh->b_blocknr * (bh->b_size >> 9);
302 bio->bi_bdev = bh->b_bdev;
303 bio->bi_private = io->io_end = io_end;
304 bio->bi_end_io = ext4_end_bio;
305
bd2d0210
TT
306 io_end->offset = (page->index << PAGE_CACHE_SHIFT) + bh_offset(bh);
307
308 io->io_bio = bio;
721a9602 309 io->io_op = (wbc->sync_mode == WB_SYNC_ALL ? WRITE_SYNC : WRITE);
bd2d0210
TT
310 io->io_next_block = bh->b_blocknr;
311 return 0;
312}
313
314static int io_submit_add_bh(struct ext4_io_submit *io,
315 struct ext4_io_page *io_page,
316 struct inode *inode,
317 struct writeback_control *wbc,
318 struct buffer_head *bh)
319{
320 ext4_io_end_t *io_end;
321 int ret;
322
323 if (buffer_new(bh)) {
324 clear_buffer_new(bh);
325 unmap_underlying_metadata(bh->b_bdev, bh->b_blocknr);
326 }
327
328 if (!buffer_mapped(bh) || buffer_delay(bh)) {
329 if (!buffer_mapped(bh))
330 clear_buffer_dirty(bh);
331 if (io->io_bio)
332 ext4_io_submit(io);
333 return 0;
334 }
335
336 if (io->io_bio && bh->b_blocknr != io->io_next_block) {
337submit_and_retry:
338 ext4_io_submit(io);
339 }
340 if (io->io_bio == NULL) {
341 ret = io_submit_init(io, inode, wbc, bh);
342 if (ret)
343 return ret;
344 }
345 io_end = io->io_end;
346 if ((io_end->num_io_pages >= MAX_IO_PAGES) &&
347 (io_end->pages[io_end->num_io_pages-1] != io_page))
348 goto submit_and_retry;
0edeb71d
TM
349 if (buffer_uninit(bh))
350 ext4_set_io_unwritten_flag(inode, io_end);
bd2d0210
TT
351 io->io_end->size += bh->b_size;
352 io->io_next_block++;
353 ret = bio_add_page(io->io_bio, bh->b_page, bh->b_size, bh_offset(bh));
354 if (ret != bh->b_size)
355 goto submit_and_retry;
356 if ((io_end->num_io_pages == 0) ||
357 (io_end->pages[io_end->num_io_pages-1] != io_page)) {
358 io_end->pages[io_end->num_io_pages++] = io_page;
83668e71 359 atomic_inc(&io_page->p_count);
bd2d0210
TT
360 }
361 return 0;
362}
363
364int ext4_bio_write_page(struct ext4_io_submit *io,
365 struct page *page,
366 int len,
367 struct writeback_control *wbc)
368{
369 struct inode *inode = page->mapping->host;
370 unsigned block_start, block_end, blocksize;
371 struct ext4_io_page *io_page;
372 struct buffer_head *bh, *head;
373 int ret = 0;
374
375 blocksize = 1 << inode->i_blkbits;
376
d50bdd5a 377 BUG_ON(!PageLocked(page));
bd2d0210 378 BUG_ON(PageWriteback(page));
bd2d0210
TT
379
380 io_page = kmem_cache_alloc(io_page_cachep, GFP_NOFS);
381 if (!io_page) {
382 set_page_dirty(page);
383 unlock_page(page);
384 return -ENOMEM;
385 }
386 io_page->p_page = page;
83668e71 387 atomic_set(&io_page->p_count, 1);
bd2d0210 388 get_page(page);
a54aa761
TT
389 set_page_writeback(page);
390 ClearPageError(page);
bd2d0210
TT
391
392 for (bh = head = page_buffers(page), block_start = 0;
393 bh != head || !block_start;
394 block_start = block_end, bh = bh->b_this_page) {
d50bdd5a 395
bd2d0210
TT
396 block_end = block_start + blocksize;
397 if (block_start >= len) {
5a0dc736
YY
398 /*
399 * Comments copied from block_write_full_page_endio:
400 *
401 * The page straddles i_size. It must be zeroed out on
402 * each and every writepage invocation because it may
403 * be mmapped. "A file is mapped in multiples of the
404 * page size. For a file that is not a multiple of
405 * the page size, the remaining memory is zeroed when
406 * mapped, and writes to that region are not written
407 * out to the file."
408 */
409 zero_user_segment(page, block_start, block_end);
bd2d0210
TT
410 clear_buffer_dirty(bh);
411 set_buffer_uptodate(bh);
412 continue;
413 }
d50bdd5a 414 clear_buffer_dirty(bh);
bd2d0210
TT
415 ret = io_submit_add_bh(io, io_page, inode, wbc, bh);
416 if (ret) {
417 /*
418 * We only get here on ENOMEM. Not much else
419 * we can do but mark the page as dirty, and
420 * better luck next time.
421 */
422 set_page_dirty(page);
423 break;
424 }
425 }
426 unlock_page(page);
427 /*
428 * If the page was truncated before we could do the writeback,
429 * or we had a memory allocation error while trying to write
430 * the first buffer head, we won't have submitted any pages for
431 * I/O. In that case we need to make sure we've cleared the
432 * PageWriteback bit from the page to prevent the system from
433 * wedging later on.
434 */
83668e71 435 put_io_page(io_page);
bd2d0210
TT
436 return ret;
437}