5 files changed, 115 insertions, 116 deletions

diff --git a/fs/ext3/dir.c b/fs/ext3/dir.c
index 5853f4440af4..3d724a95882f 100644
--- a/fs/ext3/dir.c
+++ b/fs/ext3/dir.c
@@ -42,7 +42,7 @@ const struct file_operations ext3_dir_operations = {
         .llseek         = generic_file_llseek,
         .read           = generic_read_dir,
         .readdir        = ext3_readdir,         /* we take BKL. needed?*/
-        .ioctl          = ext3_ioctl,           /* BKL held */
+        .unlocked_ioctl = ext3_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl   = ext3_compat_ioctl,
 #endif
diff --git a/fs/ext3/file.c b/fs/ext3/file.c
index 3be1e0689c9a..521f8238b2fa 100644
--- a/fs/ext3/file.c
+++ b/fs/ext3/file.c
@@ -112,7 +112,7 @@ const struct file_operations ext3_file_operations = {
         .write          = do_sync_write,
         .aio_read       = generic_file_aio_read,
         .aio_write      = ext3_file_write,
-        .ioctl          = ext3_ioctl,
+        .unlocked_ioctl = ext3_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl   = ext3_compat_ioctl,
 #endif
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 4a09ff169870..d3ef6566b019 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1149,12 +1149,15 @@ static int ext3_write_begin(struct file *file, struct address_space *mapping,
                                 struct page **pagep, void **fsdata)
 {
         struct inode *inode = mapping->host;
-        int ret, needed_blocks = ext3_writepage_trans_blocks(inode);
+        int ret;
         handle_t *handle;
         int retries = 0;
         struct page *page;
         pgoff_t index;
         unsigned from, to;
+        /* Reserve one block more for addition to orphan list in case
+         * we allocate blocks but write fails for some reason */
+        int needed_blocks = ext3_writepage_trans_blocks(inode) + 1;
 
         index = pos >> PAGE_CACHE_SHIFT;
         from = pos & (PAGE_CACHE_SIZE - 1);
@@ -1184,15 +1187,20 @@ retry:
         }
 write_begin_failed:
         if (ret) {
-                ext3_journal_stop(handle);
-                unlock_page(page);
-                page_cache_release(page);
                 /*
                  * block_write_begin may have instantiated a few blocks
                  * outside i_size.  Trim these off again. Don't need
                  * i_size_read because we hold i_mutex.
+                 *
+                 * Add inode to orphan list in case we crash before truncate
+                 * finishes.
                  */
                 if (pos + len > inode->i_size)
+                        ext3_orphan_add(handle, inode);
+                ext3_journal_stop(handle);
+                unlock_page(page);
+                page_cache_release(page);
+                if (pos + len > inode->i_size)
                         vmtruncate(inode, inode->i_size);
         }
         if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
@@ -1211,6 +1219,18 @@ int ext3_journal_dirty_data(handle_t *handle, struct buffer_head *bh)
         return err;
 }
 
+/* For ordered writepage and write_end functions */
+static int journal_dirty_data_fn(handle_t *handle, struct buffer_head *bh)
+{
+        /*
+         * Write could have mapped the buffer but it didn't copy the data in
+         * yet. So avoid filing such buffer into a transaction.
+         */
+        if (buffer_mapped(bh) && buffer_uptodate(bh))
+                return ext3_journal_dirty_data(handle, bh);
+        return 0;
+}
+
 /* For write_end() in data=journal mode */
 static int write_end_fn(handle_t *handle, struct buffer_head *bh)
 {
@@ -1221,26 +1241,20 @@ static int write_end_fn(handle_t *handle, struct buffer_head *bh)
 }
 
 /*
- * Generic write_end handler for ordered and writeback ext3 journal modes.
- * We can't use generic_write_end, because that unlocks the page and we need to
- * unlock the page after ext3_journal_stop, but ext3_journal_stop must run
- * after block_write_end.
+ * This is nasty and subtle: ext3_write_begin() could have allocated blocks
+ * for the whole page but later we failed to copy the data in. Update inode
+ * size according to what we managed to copy. The rest is going to be
+ * truncated in write_end function.
  */
-static int ext3_generic_write_end(struct file *file,
-                                struct address_space *mapping,
-                                loff_t pos, unsigned len, unsigned copied,
-                                struct page *page, void *fsdata)
+static void update_file_sizes(struct inode *inode, loff_t pos, unsigned copied)
 {
-        struct inode *inode = file->f_mapping->host;
-
-        copied = block_write_end(file, mapping, pos, len, copied, page, fsdata);
-
-        if (pos+copied > inode->i_size) {
-                i_size_write(inode, pos+copied);
+        /* What matters to us is i_disksize. We don't write i_size anywhere */
+        if (pos + copied > inode->i_size)
+                i_size_write(inode, pos + copied);
+        if (pos + copied > EXT3_I(inode)->i_disksize) {
+                EXT3_I(inode)->i_disksize = pos + copied;
                 mark_inode_dirty(inode);
         }
-
-        return copied;
 }
 
 /*
@@ -1260,35 +1274,29 @@ static int ext3_ordered_write_end(struct file *file,
         unsigned from, to;
         int ret = 0, ret2;
 
-        from = pos & (PAGE_CACHE_SIZE - 1);
-        to = from + len;
+        copied = block_write_end(file, mapping, pos, len, copied, page, fsdata);
 
+        from = pos & (PAGE_CACHE_SIZE - 1);
+        to = from + copied;
         ret = walk_page_buffers(handle, page_buffers(page),
-                from, to, NULL, ext3_journal_dirty_data);
+                from, to, NULL, journal_dirty_data_fn);
 
-        if (ret == 0) {
-                /*
-                 * generic_write_end() will run mark_inode_dirty() if i_size
-                 * changes.  So let's piggyback the i_disksize mark_inode_dirty
-                 * into that.
-                 */
-                loff_t new_i_size;
-
-                new_i_size = pos + copied;
-                if (new_i_size > EXT3_I(inode)->i_disksize)
-                        EXT3_I(inode)->i_disksize = new_i_size;
-                ret2 = ext3_generic_write_end(file, mapping, pos, len, copied,
-                                                        page, fsdata);
-                copied = ret2;
-                if (ret2 < 0)
-                        ret = ret2;
-        }
+        if (ret == 0)
+                update_file_sizes(inode, pos, copied);
+        /*
+         * There may be allocated blocks outside of i_size because
+         * we failed to copy some data. Prepare for truncate.
+         */
+        if (pos + len > inode->i_size)
+                ext3_orphan_add(handle, inode);
         ret2 = ext3_journal_stop(handle);
         if (!ret)
                 ret = ret2;
         unlock_page(page);
         page_cache_release(page);
 
+        if (pos + len > inode->i_size)
+                vmtruncate(inode, inode->i_size);
         return ret ? ret : copied;
 }
 
@@ -1299,25 +1307,22 @@ static int ext3_writeback_write_end(struct file *file,
 {
         handle_t *handle = ext3_journal_current_handle();
         struct inode *inode = file->f_mapping->host;
-        int ret = 0, ret2;
-        loff_t new_i_size;
-
-        new_i_size = pos + copied;
-        if (new_i_size > EXT3_I(inode)->i_disksize)
-                EXT3_I(inode)->i_disksize = new_i_size;
-
-        ret2 = ext3_generic_write_end(file, mapping, pos, len, copied,
-                                                        page, fsdata);
-        copied = ret2;
-        if (ret2 < 0)
-                ret = ret2;
+        int ret;
 
-        ret2 = ext3_journal_stop(handle);
-        if (!ret)
-                ret = ret2;
+        copied = block_write_end(file, mapping, pos, len, copied, page, fsdata);
+        update_file_sizes(inode, pos, copied);
+        /*
+         * There may be allocated blocks outside of i_size because
+         * we failed to copy some data. Prepare for truncate.
+         */
+        if (pos + len > inode->i_size)
+                ext3_orphan_add(handle, inode);
+        ret = ext3_journal_stop(handle);
         unlock_page(page);
         page_cache_release(page);
 
+        if (pos + len > inode->i_size)
+                vmtruncate(inode, inode->i_size);
         return ret ? ret : copied;
 }
 
@@ -1338,15 +1343,23 @@ static int ext3_journalled_write_end(struct file *file,
         if (copied < len) {
                 if (!PageUptodate(page))
                         copied = 0;
-                page_zero_new_buffers(page, from+copied, to);
+                page_zero_new_buffers(page, from + copied, to);
+                to = from + copied;
         }
 
         ret = walk_page_buffers(handle, page_buffers(page), from,
                                 to, &partial, write_end_fn);
         if (!partial)
                 SetPageUptodate(page);
-        if (pos+copied > inode->i_size)
-                i_size_write(inode, pos+copied);
+
+        if (pos + copied > inode->i_size)
+                i_size_write(inode, pos + copied);
+        /*
+         * There may be allocated blocks outside of i_size because
+         * we failed to copy some data. Prepare for truncate.
+         */
+        if (pos + len > inode->i_size)
+                ext3_orphan_add(handle, inode);
         EXT3_I(inode)->i_state |= EXT3_STATE_JDATA;
         if (inode->i_size > EXT3_I(inode)->i_disksize) {
                 EXT3_I(inode)->i_disksize = inode->i_size;
@@ -1361,6 +1374,8 @@ static int ext3_journalled_write_end(struct file *file,
         unlock_page(page);
         page_cache_release(page);
 
+        if (pos + len > inode->i_size)
+                vmtruncate(inode, inode->i_size);
         return ret ? ret : copied;
 }
 
@@ -1428,17 +1443,11 @@ static int bput_one(handle_t *handle, struct buffer_head *bh)
         return 0;
 }
 
-static int journal_dirty_data_fn(handle_t *handle, struct buffer_head *bh)
-{
-        if (buffer_mapped(bh))
-                return ext3_journal_dirty_data(handle, bh);
-        return 0;
-}
-
 static int buffer_unmapped(handle_t *handle, struct buffer_head *bh)
 {
         return !buffer_mapped(bh);
 }
+
 /*
  * Note that we always start a transaction even if we're not journalling
  * data.  This is to preserve ordering: any hole instantiation within
diff --git a/fs/ext3/ioctl.c b/fs/ext3/ioctl.c
index 5e86ce9a86e0..88974814783a 100644
--- a/fs/ext3/ioctl.c
+++ b/fs/ext3/ioctl.c
@@ -15,12 +15,11 @@
 #include <linux/mount.h>
 #include <linux/time.h>
 #include <linux/compat.h>
-#include <linux/smp_lock.h>
 #include <asm/uaccess.h>
 
-int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
-                unsigned long arg)
+long ext3_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
+        struct inode *inode = filp->f_dentry->d_inode;
         struct ext3_inode_info *ei = EXT3_I(inode);
         unsigned int flags;
         unsigned short rsv_window_size;
@@ -39,29 +38,25 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                 unsigned int oldflags;
                 unsigned int jflag;
 
+                if (!is_owner_or_cap(inode))
+                        return -EACCES;
+
+                if (get_user(flags, (int __user *) arg))
+                        return -EFAULT;
+
                 err = mnt_want_write(filp->f_path.mnt);
                 if (err)
                         return err;
 
-                if (!is_owner_or_cap(inode)) {
-                        err = -EACCES;
-                        goto flags_out;
-                }
-
-                if (get_user(flags, (int __user *) arg)) {
-                        err = -EFAULT;
-                        goto flags_out;
-                }
-
                 flags = ext3_mask_flags(inode->i_mode, flags);
 
                 mutex_lock(&inode->i_mutex);
+
                 /* Is it quota file? Do not allow user to mess with it */
-                if (IS_NOQUOTA(inode)) {
-                        mutex_unlock(&inode->i_mutex);
-                        err = -EPERM;
+                err = -EPERM;
+                if (IS_NOQUOTA(inode))
                         goto flags_out;
-                }
+
                 oldflags = ei->i_flags;
 
                 /* The JOURNAL_DATA flag is modifiable only by root */
@@ -74,11 +69,8 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                  * This test looks nicer. Thanks to Pauline Middelink
                  */
                 if ((flags ^ oldflags) & (EXT3_APPEND_FL | EXT3_IMMUTABLE_FL)) {
-                        if (!capable(CAP_LINUX_IMMUTABLE)) {
-                                mutex_unlock(&inode->i_mutex);
-                                err = -EPERM;
+                        if (!capable(CAP_LINUX_IMMUTABLE))
                                 goto flags_out;
-                        }
                 }
 
                 /*
@@ -86,17 +78,12 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                  * the relevant capability.
                  */
                 if ((jflag ^ oldflags) & (EXT3_JOURNAL_DATA_FL)) {
-                        if (!capable(CAP_SYS_RESOURCE)) {
-                                mutex_unlock(&inode->i_mutex);
-                                err = -EPERM;
+                        if (!capable(CAP_SYS_RESOURCE))
                                 goto flags_out;
-                        }
                 }
 
-
                 handle = ext3_journal_start(inode, 1);
                 if (IS_ERR(handle)) {
-                        mutex_unlock(&inode->i_mutex);
                         err = PTR_ERR(handle);
                         goto flags_out;
                 }
@@ -116,15 +103,13 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                 err = ext3_mark_iloc_dirty(handle, inode, &iloc);
 flags_err:
                 ext3_journal_stop(handle);
-                if (err) {
-                        mutex_unlock(&inode->i_mutex);
-                        return err;
-                }
+                if (err)
+                        goto flags_out;
 
                 if ((jflag ^ oldflags) & (EXT3_JOURNAL_DATA_FL))
                         err = ext3_change_inode_journal_flag(inode, jflag);
-                mutex_unlock(&inode->i_mutex);
 flags_out:
+                mutex_unlock(&inode->i_mutex);
                 mnt_drop_write(filp->f_path.mnt);
                 return err;
         }
@@ -140,6 +125,7 @@ flags_out:
 
                 if (!is_owner_or_cap(inode))
                         return -EPERM;
+
                 err = mnt_want_write(filp->f_path.mnt);
                 if (err)
                         return err;
@@ -147,6 +133,7 @@ flags_out:
                         err = -EFAULT;
                         goto setversion_out;
                 }
+
                 handle = ext3_journal_start(inode, 1);
                 if (IS_ERR(handle)) {
                         err = PTR_ERR(handle);
@@ -299,9 +286,6 @@ group_add_out:
 #ifdef CONFIG_COMPAT
 long ext3_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-        struct inode *inode = file->f_path.dentry->d_inode;
-        int ret;
-
         /* These are just misnamed, they actually get/put from/to user an int */
         switch (cmd) {
         case EXT3_IOC32_GETFLAGS:
@@ -341,9 +325,6 @@ long ext3_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         default:
                 return -ENOIOCTLCMD;
         }
-        lock_kernel();
-        ret = ext3_ioctl(inode, file, cmd, (unsigned long) compat_ptr(arg));
-        unlock_kernel();
-        return ret;
+        return ext3_ioctl(file, cmd, (unsigned long) compat_ptr(arg));
 }
 #endif
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index e2fc63cbba8b..6ddaa0a42b24 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -161,12 +161,12 @@ static struct dx_frame *dx_probe(struct qstr *entry,
                                  struct dx_frame *frame,
                                  int *err);
 static void dx_release (struct dx_frame *frames);
-static int dx_make_map (struct ext3_dir_entry_2 *de, int size,
+static int dx_make_map(struct ext3_dir_entry_2 *de, unsigned blocksize,
                         struct dx_hash_info *hinfo, struct dx_map_entry map[]);
 static void dx_sort_map(struct dx_map_entry *map, unsigned count);
 static struct ext3_dir_entry_2 *dx_move_dirents (char *from, char *to,
                 struct dx_map_entry *offsets, int count);
-static struct ext3_dir_entry_2* dx_pack_dirents (char *base, int size);
+static struct ext3_dir_entry_2 *dx_pack_dirents(char *base, unsigned blocksize);
 static void dx_insert_block (struct dx_frame *frame, u32 hash, u32 block);
 static int ext3_htree_next_block(struct inode *dir, __u32 hash,
                                  struct dx_frame *frame,
@@ -708,14 +708,14 @@ errout:
  * Create map of hash values, offsets, and sizes, stored at end of block.
  * Returns number of entries mapped.
  */
-static int dx_make_map (struct ext3_dir_entry_2 *de, int size,
-                        struct dx_hash_info *hinfo, struct dx_map_entry *map_tail)
+static int dx_make_map(struct ext3_dir_entry_2 *de, unsigned blocksize,
+                struct dx_hash_info *hinfo, struct dx_map_entry *map_tail)
 {
         int count = 0;
         char *base = (char *) de;
         struct dx_hash_info h = *hinfo;
 
-        while ((char *) de < base + size)
+        while ((char *) de < base + blocksize)
         {
                 if (de->name_len && de->inode) {
                         ext3fs_dirhash(de->name, de->name_len, &h);
@@ -1047,8 +1047,16 @@ static struct dentry *ext3_lookup(struct inode * dir, struct dentry *dentry, str
                         return ERR_PTR(-EIO);
                 }
                 inode = ext3_iget(dir->i_sb, ino);
-                if (IS_ERR(inode))
-                        return ERR_CAST(inode);
+                if (unlikely(IS_ERR(inode))) {
+                        if (PTR_ERR(inode) == -ESTALE) {
+                                ext3_error(dir->i_sb, __func__,
+                                                "deleted inode referenced: %lu",
+                                                ino);
+                                return ERR_PTR(-EIO);
+                        } else {
+                                return ERR_CAST(inode);
+                        }
+                }
         }
         return d_splice_alias(inode, dentry);
 }
@@ -1120,13 +1128,14 @@ dx_move_dirents(char *from, char *to, struct dx_map_entry *map, int count)
  * Compact each dir entry in the range to the minimal rec_len.
  * Returns pointer to last entry in range.
  */
-static struct ext3_dir_entry_2* dx_pack_dirents(char *base, int size)
+static struct ext3_dir_entry_2 *dx_pack_dirents(char *base, unsigned blocksize)
 {
-        struct ext3_dir_entry_2 *next, *to, *prev, *de = (struct ext3_dir_entry_2 *) base;
+        struct ext3_dir_entry_2 *next, *to, *prev;
+        struct ext3_dir_entry_2 *de = (struct ext3_dir_entry_2 *)base;
         unsigned rec_len = 0;
 
         prev = to = de;
-        while ((char*)de < base + size) {
+        while ((char *)de < base + blocksize) {
                 next = ext3_next_entry(de);
                 if (de->inode && de->name_len) {
                         rec_len = EXT3_DIR_REC_LEN(de->name_len);