ext3: add an option to control error handling on file data

If the journal doesn't abort when it gets an IO error in file data blocks,
the file data corruption will spread silently.  Because most of
applications and commands do buffered writes without fsync(), they don't
notice the IO error.  It's scary for mission critical systems.  On the
other hand, if the journal aborts whenever it gets an IO error in file
data blocks, the system will easily become inoperable.  So this patch
introduces a filesystem option to determine whether it aborts the journal
or just call printk() when it gets an IO error in file data.

If you mount a ext3 fs with data_err=abort option, it aborts on file data
write error.  If you mount it with data_err=ignore, it doesn't abort, just
call printk().  data_err=ignore is the default.

Signed-off-by: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>
Cc: Jan Kara <jack@ucw.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2 files changed, 18 insertions, 0 deletions

diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 399a96a6c556..3a260af5544d 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -625,6 +625,9 @@ static int ext3_show_options(struct seq_file *seq, struct vfsmount *vfs)
         else if (test_opt(sb, DATA_FLAGS) == EXT3_MOUNT_WRITEBACK_DATA)
                 seq_puts(seq, ",data=writeback");
 
+        if (test_opt(sb, DATA_ERR_ABORT))
+                seq_puts(seq, ",data_err=abort");
+
         ext3_show_quota_options(seq, sb);
 
         return 0;
@@ -754,6 +757,7 @@ enum {
         Opt_reservation, Opt_noreservation, Opt_noload, Opt_nobh, Opt_bh,
         Opt_commit, Opt_journal_update, Opt_journal_inum, Opt_journal_dev,
         Opt_abort, Opt_data_journal, Opt_data_ordered, Opt_data_writeback,
+        Opt_data_err_abort, Opt_data_err_ignore,
         Opt_usrjquota, Opt_grpjquota, Opt_offusrjquota, Opt_offgrpjquota,
         Opt_jqfmt_vfsold, Opt_jqfmt_vfsv0, Opt_quota, Opt_noquota,
         Opt_ignore, Opt_barrier, Opt_err, Opt_resize, Opt_usrquota,
@@ -796,6 +800,8 @@ static const match_table_t tokens = {
         {Opt_data_journal, "data=journal"},
         {Opt_data_ordered, "data=ordered"},
         {Opt_data_writeback, "data=writeback"},
+        {Opt_data_err_abort, "data_err=abort"},
+        {Opt_data_err_ignore, "data_err=ignore"},
         {Opt_offusrjquota, "usrjquota="},
         {Opt_usrjquota, "usrjquota=%s"},
         {Opt_offgrpjquota, "grpjquota="},
@@ -1011,6 +1017,12 @@ static int parse_options (char *options, struct super_block *sb,
                                 sbi->s_mount_opt |= data_opt;
                         }
                         break;
+                case Opt_data_err_abort:
+                        set_opt(sbi->s_mount_opt, DATA_ERR_ABORT);
+                        break;
+                case Opt_data_err_ignore:
+                        clear_opt(sbi->s_mount_opt, DATA_ERR_ABORT);
+                        break;
 #ifdef CONFIG_QUOTA
                 case Opt_usrjquota:
                         qtype = USRQUOTA;
@@ -1986,6 +1998,10 @@ static void ext3_init_journal_params(struct super_block *sb, journal_t *journal)
                 journal->j_flags |= JFS_BARRIER;
         else
                 journal->j_flags &= ~JFS_BARRIER;
+        if (test_opt(sb, DATA_ERR_ABORT))
+                journal->j_flags |= JFS_ABORT_ON_SYNCDATA_ERR;
+        else
+                journal->j_flags &= ~JFS_ABORT_ON_SYNCDATA_ERR;
         spin_unlock(&journal->j_state_lock);
 }
 
diff --git a/fs/jbd/commit.c b/fs/jbd/commit.c
index d6a6659f3e46..25719d902c51 100644
--- a/fs/jbd/commit.c
+++ b/fs/jbd/commit.c
@@ -482,6 +482,8 @@ void journal_commit_transaction(journal_t *journal)
                 printk(KERN_WARNING
                         "JBD: Detected IO errors while flushing file data "
                         "on %s\n", bdevname(journal->j_fs_dev, b));
+                if (journal->j_flags & JFS_ABORT_ON_SYNCDATA_ERR)
+                        journal_abort(journal, err);
                 err = 0;
         }