jbd2/ocfs2: Fix block checksumming when a buffer is used in several transactions

OCFS2 uses t_commit trigger to compute and store checksum of the just
committed blocks. When a buffer has b_frozen_data, checksum is computed
for it instead of b_data but this can result in an old checksum being
written to the filesystem in the following scenario:

1) transaction1 is opened
2) handle1 is opened
3) journal_access(handle1, bh)
    - This sets jh->b_transaction to transaction1
4) modify(bh)
5) journal_dirty(handle1, bh)
6) handle1 is closed
7) start committing transaction1, opening transaction2
8) handle2 is opened
9) journal_access(handle2, bh)
    - This copies off b_frozen_data to make it safe for transaction1 to commit.
      jh->b_next_transaction is set to transaction2.
10) jbd2_journal_write_metadata() checksums b_frozen_data
11) the journal correctly writes b_frozen_data to the disk journal
12) handle2 is closed
    - There was no dirty call for the bh on handle2, so it is never queued for
      any more journal operation
13) Checkpointing finally happens, and it just spools the bh via normal buffer
writeback.  This will write b_data, which was never triggered on and thus
contains a wrong (old) checksum.

This patch fixes the problem by calling the trigger at the moment data is
frozen for journal commit - i.e., either when b_frozen_data is created by
do_get_write_access or just before we write a buffer to the log if
b_frozen_data does not exist. We also rename the trigger to t_frozen as
that better describes when it is called.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Joel Becker <joel.becker@oracle.com>

2 files changed, 13 insertions, 11 deletions

diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index bc2ff5932769..036880895bfc 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -297,7 +297,6 @@ int jbd2_journal_write_metadata_buffer(transaction_t *transaction,
         struct page *new_page;
         unsigned int new_offset;
         struct buffer_head *bh_in = jh2bh(jh_in);
-        struct jbd2_buffer_trigger_type *triggers;
         journal_t *journal = transaction->t_journal;
 
         /*
@@ -328,21 +327,21 @@ repeat:
                 done_copy_out = 1;
                 new_page = virt_to_page(jh_in->b_frozen_data);
                 new_offset = offset_in_page(jh_in->b_frozen_data);
-                triggers = jh_in->b_frozen_triggers;
         } else {
                 new_page = jh2bh(jh_in)->b_page;
                 new_offset = offset_in_page(jh2bh(jh_in)->b_data);
-                triggers = jh_in->b_triggers;
         }
 
         mapped_data = kmap_atomic(new_page, KM_USER0);
         /*
-         * Fire any commit trigger.  Do this before checking for escaping,
-         * as the trigger may modify the magic offset.  If a copy-out
-         * happens afterwards, it will have the correct data in the buffer.
+         * Fire data frozen trigger if data already wasn't frozen.  Do this
+         * before checking for escaping, as the trigger may modify the magic
+         * offset.  If a copy-out happens afterwards, it will have the correct
+         * data in the buffer.
          */
-        jbd2_buffer_commit_trigger(jh_in, mapped_data + new_offset,
-                                   triggers);
+        if (!done_copy_out)
+                jbd2_buffer_frozen_trigger(jh_in, mapped_data + new_offset,
+                                           jh_in->b_triggers);
 
         /*
          * Check for escaping
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index e214d68620ac..b8e0806681bb 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -725,6 +725,9 @@ done:
                 page = jh2bh(jh)->b_page;
                 offset = ((unsigned long) jh2bh(jh)->b_data) & ~PAGE_MASK;
                 source = kmap_atomic(page, KM_USER0);
+                /* Fire data frozen trigger just before we copy the data */
+                jbd2_buffer_frozen_trigger(jh, source + offset,
+                                           jh->b_triggers);
                 memcpy(jh->b_frozen_data, source+offset, jh2bh(jh)->b_size);
                 kunmap_atomic(source, KM_USER0);
 
@@ -963,15 +966,15 @@ void jbd2_journal_set_triggers(struct buffer_head *bh,
         jh->b_triggers = type;
 }
 
-void jbd2_buffer_commit_trigger(struct journal_head *jh, void *mapped_data,
+void jbd2_buffer_frozen_trigger(struct journal_head *jh, void *mapped_data,
                                 struct jbd2_buffer_trigger_type *triggers)
 {
         struct buffer_head *bh = jh2bh(jh);
 
-        if (!triggers || !triggers->t_commit)
+        if (!triggers || !triggers->t_frozen)
                 return;
 
-        triggers->t_commit(triggers, bh, mapped_data, bh->b_size);
+        triggers->t_frozen(triggers, bh, mapped_data, bh->b_size);
 }
 
 void jbd2_buffer_abort_trigger(struct journal_head *jh,