提交 0061280d 编写于 作者: M Miao Xie 提交者: Chris Mason

Btrfs: fix the page that is beyond EOF

Steps to reproduce:
 # mkfs.btrfs <disk>
 # mount <disk> <mnt>
 # dd if=/dev/zero of=<mnt>/<file> bs=512 seek=5 count=8
 # fallocate -p -o 2048 -l 16384 <mnt>/<file>
 # dd if=/dev/zero of=<mnt>/<file> bs=4096 seek=3 count=8 conv=notrunc,nocreat
 # umount <mnt>
 # dmesg
 WARNING: at fs/btrfs/inode.c:7140 btrfs_destroy_inode+0x2eb/0x330

The reason is that we inputed a range which is beyond the end of the file. And
because the end of this range was not page-aligned, we had to truncate the last
page in this range, this operation is similar to a buffered file write. In other
words, we reserved enough space and clear the data which was in the hole range
on that page. But when we expanded that test file, write the data into the same
page, we forgot that we have reserved enough space for the buffered write of
that page because in most cases there is no page that is beyond the end of
the file. As a result, we reserved the space twice.

In fact, we needn't truncate the page if it is beyond the end of the file, just
release the allocated space in that range. Fix the above problem by this way.
Signed-off-by: NMiao Xie <miaox@cn.fujitsu.com>
Signed-off-by: NChris Mason <chris.mason@fusionio.com>
上级 6347b3c4
...@@ -1859,9 +1859,9 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len) ...@@ -1859,9 +1859,9 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
struct btrfs_path *path; struct btrfs_path *path;
struct btrfs_block_rsv *rsv; struct btrfs_block_rsv *rsv;
struct btrfs_trans_handle *trans; struct btrfs_trans_handle *trans;
u64 mask = BTRFS_I(inode)->root->sectorsize - 1; u64 lockstart = round_up(offset, BTRFS_I(inode)->root->sectorsize);
u64 lockstart = (offset + mask) & ~mask; u64 lockend = round_down(offset + len,
u64 lockend = ((offset + len) & ~mask) - 1; BTRFS_I(inode)->root->sectorsize) - 1;
u64 cur_offset = lockstart; u64 cur_offset = lockstart;
u64 min_size = btrfs_calc_trunc_metadata_size(root, 1); u64 min_size = btrfs_calc_trunc_metadata_size(root, 1);
u64 drop_end; u64 drop_end;
...@@ -1896,10 +1896,12 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len) ...@@ -1896,10 +1896,12 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
} }
/* zero the front end of the last page */ /* zero the front end of the last page */
ret = btrfs_truncate_page(inode, offset + len, 0, 1); if (offset + len < round_up(inode->i_size, PAGE_CACHE_SIZE)) {
if (ret) { ret = btrfs_truncate_page(inode, offset + len, 0, 1);
mutex_unlock(&inode->i_mutex); if (ret) {
return ret; mutex_unlock(&inode->i_mutex);
return ret;
}
} }
if (lockend < lockstart) { if (lockend < lockstart) {
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册