3 files changed, 30 insertions, 5 deletions

diff --git a/fs/buffer.c b/fs/buffer.c
index b4dcb34c9635..71578d69b82d 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2949,7 +2949,7 @@ static void guard_bh_eod(int rw, struct bio *bio, struct buffer_head *bh)
         }
 }
 
-int submit_bh(int rw, struct buffer_head * bh)
+int _submit_bh(int rw, struct buffer_head *bh, unsigned long bio_flags)
 {
         struct bio *bio;
         int ret = 0;
@@ -2984,6 +2984,7 @@ int submit_bh(int rw, struct buffer_head * bh)
 
         bio->bi_end_io = end_bio_bh_io_sync;
         bio->bi_private = bh;
+        bio->bi_flags |= bio_flags;
 
         /* Take care of bh's that straddle the end of the device */
         guard_bh_eod(rw, bio, bh);
@@ -2997,6 +2998,12 @@ int submit_bh(int rw, struct buffer_head * bh)
         bio_put(bio);
         return ret;
 }
+EXPORT_SYMBOL_GPL(_submit_bh);
+
+int submit_bh(int rw, struct buffer_head *bh)
+{
+        return _submit_bh(rw, bh, 0);
+}
 EXPORT_SYMBOL(submit_bh);
 
 /**
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index fb5120a5505c..3dc48cc8b6eb 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -2067,7 +2067,6 @@ static int ext3_fill_super (struct super_block *sb, void *data, int silent)
                 test_opt(sb,DATA_FLAGS) == EXT3_MOUNT_JOURNAL_DATA ? "journal":
                 test_opt(sb,DATA_FLAGS) == EXT3_MOUNT_ORDERED_DATA ? "ordered":
                 "writeback");
-        sb->s_flags |= MS_SNAP_STABLE;
 
         return 0;
 
diff --git a/fs/jbd/commit.c b/fs/jbd/commit.c
index 86b39b167c23..11bb11f48b3a 100644
--- a/fs/jbd/commit.c
+++ b/fs/jbd/commit.c
@@ -162,8 +162,17 @@ static void journal_do_submit_data(struct buffer_head **wbuf, int bufs,
 
         for (i = 0; i < bufs; i++) {
                 wbuf[i]->b_end_io = end_buffer_write_sync;
-                /* We use-up our safety reference in submit_bh() */
-                submit_bh(write_op, wbuf[i]);
+                /*
+                 * Here we write back pagecache data that may be mmaped. Since
+                 * we cannot afford to clean the page and set PageWriteback
+                 * here due to lock ordering (page lock ranks above transaction
+                 * start), the data can change while IO is in flight. Tell the
+                 * block layer it should bounce the bio pages if stable data
+                 * during write is required.
+                 *
+                 * We use up our safety reference in submit_bh().
+                 */
+                _submit_bh(write_op, wbuf[i], 1 << BIO_SNAP_STABLE);
         }
 }
 
@@ -667,7 +676,17 @@ start_journal_io:
                                 clear_buffer_dirty(bh);
                                 set_buffer_uptodate(bh);
                                 bh->b_end_io = journal_end_buffer_io_sync;
-                                submit_bh(write_op, bh);
+                                /*
+                                 * In data=journal mode, here we can end up
+                                 * writing pagecache data that might be
+                                 * mmapped. Since we can't afford to clean the
+                                 * page and set PageWriteback (see the comment
+                                 * near the other use of _submit_bh()), the
+                                 * data can change while the write is in
+                                 * flight.  Tell the block layer to bounce the
+                                 * bio pages if stable pages are required.
+                                 */
+                                _submit_bh(write_op, bh, 1 << BIO_SNAP_STABLE);
                         }
                         cond_resched();