3 files changed, 73 insertions, 20 deletions

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 2a1cb0979768..e3a55eb8b26a 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -326,11 +326,14 @@ ext4_ext_max_entries(struct inode *inode, int depth)
 
 static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
 {
-        ext4_fsblk_t block = ext_pblock(ext);
+        ext4_fsblk_t block = ext_pblock(ext), valid_block;
         int len = ext4_ext_get_actual_len(ext);
         struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es;
-        if (unlikely(block < le32_to_cpu(es->s_first_data_block) ||
-                        ((block + len) > ext4_blocks_count(es))))
+
+        valid_block = le32_to_cpu(es->s_first_data_block) +
+                EXT4_SB(inode->i_sb)->s_gdb_count;
+        if (unlikely(block <= valid_block ||
+                     ((block + len) > ext4_blocks_count(es))))
                 return 0;
         else
                 return 1;
@@ -339,10 +342,13 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
 static int ext4_valid_extent_idx(struct inode *inode,
                                 struct ext4_extent_idx *ext_idx)
 {
-        ext4_fsblk_t block = idx_pblock(ext_idx);
+        ext4_fsblk_t block = idx_pblock(ext_idx), valid_block;
         struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es;
-        if (unlikely(block < le32_to_cpu(es->s_first_data_block) ||
-                        (block >= ext4_blocks_count(es))))
+
+        valid_block = le32_to_cpu(es->s_first_data_block) +
+                EXT4_SB(inode->i_sb)->s_gdb_count;
+        if (unlikely(block <= valid_block ||
+                     (block >= ext4_blocks_count(es))))
                 return 0;
         else
                 return 1;
@@ -1835,11 +1841,13 @@ ext4_ext_put_in_cache(struct inode *inode, ext4_lblk_t block,
 {
         struct ext4_ext_cache *cex;
         BUG_ON(len == 0);
+        spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
         cex = &EXT4_I(inode)->i_cached_extent;
         cex->ec_type = type;
         cex->ec_block = block;
         cex->ec_len = len;
         cex->ec_start = start;
+        spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
 }
 
 /*
@@ -1896,12 +1904,17 @@ ext4_ext_in_cache(struct inode *inode, ext4_lblk_t block,
                         struct ext4_extent *ex)
 {
         struct ext4_ext_cache *cex;
+        int ret = EXT4_EXT_CACHE_NO;
 
+        /* 
+         * We borrow i_block_reservation_lock to protect i_cached_extent
+         */
+        spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
         cex = &EXT4_I(inode)->i_cached_extent;
 
         /* has cache valid data? */
         if (cex->ec_type == EXT4_EXT_CACHE_NO)
-                return EXT4_EXT_CACHE_NO;
+                goto errout;
 
         BUG_ON(cex->ec_type != EXT4_EXT_CACHE_GAP &&
                         cex->ec_type != EXT4_EXT_CACHE_EXTENT);
@@ -1912,11 +1925,11 @@ ext4_ext_in_cache(struct inode *inode, ext4_lblk_t block,
                 ext_debug("%u cached by %u:%u:%llu\n",
                                 block,
                                 cex->ec_block, cex->ec_len, cex->ec_start);
-                return cex->ec_type;
+                ret = cex->ec_type;
         }
-
-        /* not in cache */
-        return EXT4_EXT_CACHE_NO;
+errout:
+        spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+        return ret;
 }
 
 /*
@@ -2869,6 +2882,8 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
                                 if (allocated > max_blocks)
                                         allocated = max_blocks;
                                 set_buffer_unwritten(bh_result);
+                                bh_result->b_bdev = inode->i_sb->s_bdev;
+                                bh_result->b_blocknr = newblock;
                                 goto out2;
                         }
 
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 47b84e8df568..f18e0a08a6b5 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -585,6 +585,7 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent,
 fallback:
         ngroups = sbi->s_groups_count;
         avefreei = freei / ngroups;
+fallback_retry:
         parent_group = EXT4_I(parent)->i_block_group;
         for (i = 0; i < ngroups; i++) {
                 grp = (parent_group + i) % ngroups;
@@ -602,7 +603,7 @@ fallback:
                  * filesystems the above test can fail to find any blockgroups
                  */
                 avefreei = 0;
-                goto fallback;
+                goto fallback_retry;
         }
 
         return -1;
@@ -831,11 +832,12 @@ struct inode *ext4_new_inode(handle_t *handle, struct inode *dir, int mode)
                 ret2 = find_group_flex(sb, dir, &group);
                 if (ret2 == -1) {
                         ret2 = find_group_other(sb, dir, &group, mode);
-                        if (ret2 == 0 && once)
+                        if (ret2 == 0 && once) {
                                 once = 0;
                                 printk(KERN_NOTICE "ext4: find_group_flex "
                                        "failed, fallback succeeded dir %lu\n",
                                        dir->i_ino);
+                        }
                 }
                 goto got_group;
         }
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index c6bd6ced3bb7..2a9ffd528dd1 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1149,6 +1149,7 @@ int ext4_get_blocks_wrap(handle_t *handle, struct inode *inode, sector_t block,
         int retval;
 
         clear_buffer_mapped(bh);
+        clear_buffer_unwritten(bh);
 
         /*
          * Try to see if we can get  the block without requesting
@@ -1179,6 +1180,18 @@ int ext4_get_blocks_wrap(handle_t *handle, struct inode *inode, sector_t block,
                 return retval;
 
         /*
+         * When we call get_blocks without the create flag, the
+         * BH_Unwritten flag could have gotten set if the blocks
+         * requested were part of a uninitialized extent.  We need to
+         * clear this flag now that we are committed to convert all or
+         * part of the uninitialized extent to be an initialized
+         * extent.  This is because we need to avoid the combination
+         * of BH_Unwritten and BH_Mapped flags being simultaneously
+         * set on the buffer_head.
+         */
+        clear_buffer_unwritten(bh);
+
+        /*
          * New blocks allocate and/or writing to uninitialized extent
          * will possibly result in updating i_data, so we take
          * the write lock of i_data_sem, and call get_blocks()
@@ -2297,6 +2310,10 @@ static int ext4_da_get_block_prep(struct inode *inode, sector_t iblock,
                                   struct buffer_head *bh_result, int create)
 {
         int ret = 0;
+        sector_t invalid_block = ~((sector_t) 0xffff);
+
+        if (invalid_block < ext4_blocks_count(EXT4_SB(inode->i_sb)->s_es))
+                invalid_block = ~0;
 
         BUG_ON(create == 0);
         BUG_ON(bh_result->b_size != inode->i_sb->s_blocksize);
@@ -2318,11 +2335,18 @@ static int ext4_da_get_block_prep(struct inode *inode, sector_t iblock,
                         /* not enough space to reserve */
                         return ret;
 
-                map_bh(bh_result, inode->i_sb, 0);
+                map_bh(bh_result, inode->i_sb, invalid_block);
                 set_buffer_new(bh_result);
                 set_buffer_delay(bh_result);
         } else if (ret > 0) {
                 bh_result->b_size = (ret << inode->i_blkbits);
+                /*
+                 * With sub-block writes into unwritten extents
+                 * we also need to mark the buffer as new so that
+                 * the unwritten parts of the buffer gets correctly zeroed.
+                 */
+                if (buffer_unwritten(bh_result))
+                        set_buffer_new(bh_result);
                 ret = 0;
         }
 
@@ -4357,11 +4381,9 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
         ei->i_flags = le32_to_cpu(raw_inode->i_flags);
         inode->i_blocks = ext4_inode_blocks(raw_inode, ei);
         ei->i_file_acl = le32_to_cpu(raw_inode->i_file_acl_lo);
-        if (EXT4_SB(inode->i_sb)->s_es->s_creator_os !=
-            cpu_to_le32(EXT4_OS_HURD)) {
+        if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_64BIT))
                 ei->i_file_acl |=
                         ((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32;
-        }
         inode->i_size = ext4_isize(raw_inode);
         ei->i_disksize = inode->i_size;
         inode->i_generation = le32_to_cpu(raw_inode->i_generation);
@@ -4409,9 +4431,23 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
                         (__u64)(le32_to_cpu(raw_inode->i_version_hi)) << 32;
         }
 
-        if (ei->i_flags & EXT4_EXTENTS_FL) {
-                /* Validate extent which is part of inode */
-                ret = ext4_ext_check_inode(inode);
+        ret = 0;
+        if (ei->i_file_acl &&
+            ((ei->i_file_acl < 
+              (le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block) +
+               EXT4_SB(sb)->s_gdb_count)) ||
+             (ei->i_file_acl >= ext4_blocks_count(EXT4_SB(sb)->s_es)))) {
+                ext4_error(sb, __func__,
+                           "bad extended attribute block %llu in inode #%lu",
+                           ei->i_file_acl, inode->i_ino);
+                ret = -EIO;
+                goto bad_inode;
+        } else if (ei->i_flags & EXT4_EXTENTS_FL) {
+                if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
+                    (S_ISLNK(inode->i_mode) &&
+                     !ext4_inode_is_fast_symlink(inode)))
+                        /* Validate extent which is part of inode */
+                        ret = ext4_ext_check_inode(inode);
         } else if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
                    (S_ISLNK(inode->i_mode) &&
                     !ext4_inode_is_fast_symlink(inode))) {