ext4: Fix fsync error handling after filesystem abort

If filesystem was aborted after inode's write back is complete
but before its metadata was updated we may return success
results in data loss.
In order to handle fs abort correctly we have to check
fs state once we discover that it is in MS_RDONLY state

Test case: http://patchwork.ozlabs.org/patch/244297

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index fc938ebbddec95382daba3b947e7b0c672a4c1e6..a8bc47f75fa0946582ce5562ebdea334cead1ac6 100644 (file)
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -98,8 +98,13 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
 
        trace_ext4_sync_file_enter(file, datasync);
 
-       if (inode->i_sb->s_flags & MS_RDONLY)
+       if (inode->i_sb->s_flags & MS_RDONLY) {
+               /* Make sure that we read updated s_mount_flags value */
+               smp_rmb();
+               if (EXT4_SB(inode->i_sb)->s_mount_flags & EXT4_MF_FS_ABORTED)
+                       ret = -EROFS;
                goto out;
+       }
 
        if (!journal) {
                ret = generic_file_fsync(file, start, end, datasync);

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 0f77c2e4b8883f9fd5c3a343b703d60eae83c120..eb52a7be1fc13a174fc963614c35f849d2ef3885 100644 (file)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -399,6 +399,11 @@ static void ext4_handle_error(struct super_block *sb)
        }
        if (test_opt(sb, ERRORS_RO)) {
                ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only");
+               /*
+                * Make sure updated value of ->s_mount_flags will be visible
+                * before ->s_flags update
+                */
+               smp_wmb();
                sb->s_flags |= MS_RDONLY;
        }
        if (test_opt(sb, ERRORS_PANIC))
@@ -571,8 +576,13 @@ void __ext4_abort(struct super_block *sb, const char *function,
 
        if ((sb->s_flags & MS_RDONLY) == 0) {
                ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only");
-               sb->s_flags |= MS_RDONLY;
                EXT4_SB(sb)->s_mount_flags |= EXT4_MF_FS_ABORTED;
+               /*
+                * Make sure updated value of ->s_mount_flags will be visible
+                * before ->s_flags update
+                */
+               smp_wmb();
+               sb->s_flags |= MS_RDONLY;
                if (EXT4_SB(sb)->s_journal)
                        jbd2_journal_abort(EXT4_SB(sb)->s_journal, -EIO);
                save_error_info(sb, function, line);