ext4: add an option to control error handling on file data

If the journal doesn't abort when it gets an IO error in file data
blocks, the file data corruption will spread silently.  Because
most of applications and commands do buffered writes without fsync(),
they don't notice the IO error.  It's scary for mission critical
systems.  On the other hand, if the journal aborts whenever it gets
an IO error in file data blocks, the system will easily become
inoperable.  So this patch introduces a filesystem option to
determine whether it aborts the journal or just call printk() when
it gets an IO error in file data.

If you mount an ext4 fs with data_err=abort option, it aborts on file
data write error.  If you mount it with data_err=ignore, it doesn't
abort, just call printk().  data_err=ignore is the default.

Here is the corresponding patch of the ext3 version:
http://kerneltrap.org/mailarchive/linux-kernel/2008/9/9/3239374

Signed-off-by: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>

1 files changed, 16 insertions, 0 deletions

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 79bd3989e84f..014677b8e224 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -778,6 +778,9 @@ static int ext4_show_options(struct seq_file *seq, struct vfsmount *vfs)
                 seq_printf(seq, ",inode_readahead_blks=%u",
                            sbi->s_inode_readahead_blks);
 
+        if (test_opt(sb, DATA_ERR_ABORT))
+                seq_puts(seq, ",data_err=abort");
+
         ext4_show_quota_options(seq, sb);
         return 0;
 }
@@ -907,6 +910,7 @@ enum {
         Opt_commit, Opt_journal_update, Opt_journal_inum, Opt_journal_dev,
         Opt_journal_checksum, Opt_journal_async_commit,
         Opt_abort, Opt_data_journal, Opt_data_ordered, Opt_data_writeback,
+        Opt_data_err_abort, Opt_data_err_ignore,
         Opt_usrjquota, Opt_grpjquota, Opt_offusrjquota, Opt_offgrpjquota,
         Opt_jqfmt_vfsold, Opt_jqfmt_vfsv0, Opt_quota, Opt_noquota,
         Opt_ignore, Opt_barrier, Opt_err, Opt_resize, Opt_usrquota,
@@ -953,6 +957,8 @@ static match_table_t tokens = {
         {Opt_data_journal, "data=journal"},
         {Opt_data_ordered, "data=ordered"},
         {Opt_data_writeback, "data=writeback"},
+        {Opt_data_err_abort, "data_err=abort"},
+        {Opt_data_err_ignore, "data_err=ignore"},
         {Opt_offusrjquota, "usrjquota="},
         {Opt_usrjquota, "usrjquota=%s"},
         {Opt_offgrpjquota, "grpjquota="},
@@ -1187,6 +1193,12 @@ static int parse_options(char *options, struct super_block *sb,
                                 sbi->s_mount_opt |= data_opt;
                         }
                         break;
+                case Opt_data_err_abort:
+                        set_opt(sbi->s_mount_opt, DATA_ERR_ABORT);
+                        break;
+                case Opt_data_err_ignore:
+                        clear_opt(sbi->s_mount_opt, DATA_ERR_ABORT);
+                        break;
 #ifdef CONFIG_QUOTA
                 case Opt_usrjquota:
                         qtype = USRQUOTA;
@@ -2535,6 +2547,10 @@ static void ext4_init_journal_params(struct super_block *sb, journal_t *journal)
                 journal->j_flags |= JBD2_BARRIER;
         else
                 journal->j_flags &= ~JBD2_BARRIER;
+        if (test_opt(sb, DATA_ERR_ABORT))
+                journal->j_flags |= JBD2_ABORT_ON_SYNCDATA_ERR;
+        else
+                journal->j_flags &= ~JBD2_ABORT_ON_SYNCDATA_ERR;
         spin_unlock(&journal->j_state_lock);
 }