8 files changed, 179 insertions, 32 deletions

diff --git a/fs/ext3/Makefile b/fs/ext3/Makefile
index 704cd44a40c2..e77766a8b3f0 100644
--- a/fs/ext3/Makefile
+++ b/fs/ext3/Makefile
@@ -5,7 +5,7 @@
 obj-$(CONFIG_EXT3_FS) += ext3.o
 
 ext3-y  := balloc.o bitmap.o dir.o file.o fsync.o ialloc.o inode.o \
-           ioctl.o namei.o super.o symlink.o hash.o resize.o
+           ioctl.o namei.o super.o symlink.o hash.o resize.o ext3_jbd.o
 
 ext3-$(CONFIG_EXT3_FS_XATTR)     += xattr.o xattr_user.o xattr_trusted.o
 ext3-$(CONFIG_EXT3_FS_POSIX_ACL) += acl.o
diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
index b41a7d7e20f0..22161740ba29 100644
--- a/fs/ext3/balloc.c
+++ b/fs/ext3/balloc.c
@@ -144,7 +144,7 @@ restart:
 
         printk("Block Allocation Reservation Windows Map (%s):\n", fn);
         while (n) {
-                rsv = list_entry(n, struct ext3_reserve_window_node, rsv_node);
+                rsv = rb_entry(n, struct ext3_reserve_window_node, rsv_node);
                 if (verbose)
                         printk("reservation window 0x%p "
                                "start:  %lu, end:  %lu\n",
@@ -730,7 +730,7 @@ find_next_usable_block(ext3_grpblk_t start, struct buffer_head *bh,
                 here = 0;
 
         p = ((char *)bh->b_data) + (here >> 3);
-        r = memscan(p, 0, (maxblocks - here + 7) >> 3);
+        r = memscan(p, 0, ((maxblocks + 7) >> 3) - (here >> 3));
         next = (r - ((char *)bh->b_data)) << 3;
 
         if (next < maxblocks && next >= start && ext3_test_allocatable(next, bh))
@@ -949,7 +949,7 @@ static int find_next_reservable_window(
 
                 prev = rsv;
                 next = rb_next(&rsv->rsv_node);
-                rsv = list_entry(next,struct ext3_reserve_window_node,rsv_node);
+                rsv = rb_entry(next,struct ext3_reserve_window_node,rsv_node);
 
                 /*
                  * Reached the last reservation, we can just append to the
@@ -1148,7 +1148,7 @@ retry:
          * check if the first free block is within the
          * free space we just reserved
          */
-        if (start_block >= my_rsv->rsv_start && start_block < my_rsv->rsv_end)
+        if (start_block >= my_rsv->rsv_start && start_block <= my_rsv->rsv_end)
                 return 0;               /* success */
         /*
          * if the first free bit we found is out of the reservable space
@@ -1193,7 +1193,7 @@ static void try_to_extend_reservation(struct ext3_reserve_window_node *my_rsv,
         if (!next)
                 my_rsv->rsv_end += size;
         else {
-                next_rsv = list_entry(next, struct ext3_reserve_window_node, rsv_node);
+                next_rsv = rb_entry(next, struct ext3_reserve_window_node, rsv_node);
 
                 if ((next_rsv->rsv_start - my_rsv->rsv_end - 1) >= size)
                         my_rsv->rsv_end += size;
@@ -1271,7 +1271,7 @@ ext3_try_to_allocate_with_rsv(struct super_block *sb, handle_t *handle,
         }
         /*
          * grp_goal is a group relative block number (if there is a goal)
-         * 0 < grp_goal < EXT3_BLOCKS_PER_GROUP(sb)
+         * 0 <= grp_goal < EXT3_BLOCKS_PER_GROUP(sb)
          * first block is a filesystem wide block number
          * first block is the block number of the first block in this group
          */
@@ -1307,10 +1307,14 @@ ext3_try_to_allocate_with_rsv(struct super_block *sb, handle_t *handle,
                         if (!goal_in_my_reservation(&my_rsv->rsv_window,
                                                         grp_goal, group, sb))
                                 grp_goal = -1;
-                } else if (grp_goal > 0 &&
-                          (my_rsv->rsv_end-grp_goal+1) < *count)
-                        try_to_extend_reservation(my_rsv, sb,
-                                        *count-my_rsv->rsv_end + grp_goal - 1);
+                } else if (grp_goal >= 0) {
+                        int curr = my_rsv->rsv_end -
+                                        (grp_goal + group_first_block) + 1;
+
+                        if (curr < *count)
+                                try_to_extend_reservation(my_rsv, sb,
+                                                        *count - curr);
+                }
 
                 if ((my_rsv->rsv_start > group_last_block) ||
                                 (my_rsv->rsv_end < group_first_block)) {
@@ -1511,10 +1515,8 @@ retry_alloc:
                 if (group_no >= ngroups)
                         group_no = 0;
                 gdp = ext3_get_group_desc(sb, group_no, &gdp_bh);
-                if (!gdp) {
-                        *errp = -EIO;
-                        goto out;
-                }
+                if (!gdp)
+                        goto io_error;
                 free_blocks = le16_to_cpu(gdp->bg_free_blocks_count);
                 /*
                  * skip this group if the number of
@@ -1548,6 +1550,7 @@ retry_alloc:
          */
         if (my_rsv) {
                 my_rsv = NULL;
+                windowsz = 0;
                 group_no = goal_group;
                 goto retry_alloc;
         }
diff --git a/fs/ext3/dir.c b/fs/ext3/dir.c
index d0b54f30b914..5a9313ecd4ef 100644
--- a/fs/ext3/dir.c
+++ b/fs/ext3/dir.c
@@ -154,6 +154,9 @@ static int ext3_readdir(struct file * filp,
                         ext3_error (sb, "ext3_readdir",
                                 "directory #%lu contains a hole at offset %lu",
                                 inode->i_ino, (unsigned long)filp->f_pos);
+                        /* corrupt size?  Maybe no more blocks to read */
+                        if (filp->f_pos > inode->i_blocks << 9)
+                                break;
                         filp->f_pos += sb->s_blocksize - offset;
                         continue;
                 }
diff --git a/fs/ext3/ext3_jbd.c b/fs/ext3/ext3_jbd.c
new file mode 100644
index 000000000000..e1f91fd26a93
--- /dev/null
+++ b/fs/ext3/ext3_jbd.c
@@ -0,0 +1,59 @@
+/*
+ * Interface between ext3 and JBD
+ */
+
+#include <linux/ext3_jbd.h>
+
+int __ext3_journal_get_undo_access(const char *where, handle_t *handle,
+                                struct buffer_head *bh)
+{
+        int err = journal_get_undo_access(handle, bh);
+        if (err)
+                ext3_journal_abort_handle(where, __FUNCTION__, bh, handle,err);
+        return err;
+}
+
+int __ext3_journal_get_write_access(const char *where, handle_t *handle,
+                                struct buffer_head *bh)
+{
+        int err = journal_get_write_access(handle, bh);
+        if (err)
+                ext3_journal_abort_handle(where, __FUNCTION__, bh, handle,err);
+        return err;
+}
+
+int __ext3_journal_forget(const char *where, handle_t *handle,
+                                struct buffer_head *bh)
+{
+        int err = journal_forget(handle, bh);
+        if (err)
+                ext3_journal_abort_handle(where, __FUNCTION__, bh, handle,err);
+        return err;
+}
+
+int __ext3_journal_revoke(const char *where, handle_t *handle,
+                                unsigned long blocknr, struct buffer_head *bh)
+{
+        int err = journal_revoke(handle, blocknr, bh);
+        if (err)
+                ext3_journal_abort_handle(where, __FUNCTION__, bh, handle,err);
+        return err;
+}
+
+int __ext3_journal_get_create_access(const char *where,
+                                handle_t *handle, struct buffer_head *bh)
+{
+        int err = journal_get_create_access(handle, bh);
+        if (err)
+                ext3_journal_abort_handle(where, __FUNCTION__, bh, handle,err);
+        return err;
+}
+
+int __ext3_journal_dirty_metadata(const char *where,
+                                handle_t *handle, struct buffer_head *bh)
+{
+        int err = journal_dirty_metadata(handle, bh);
+        if (err)
+                ext3_journal_abort_handle(where, __FUNCTION__, bh, handle,err);
+        return err;
+}
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 03ba5bcab186..beaf25f5112f 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1148,37 +1148,102 @@ static int do_journal_get_write_access(handle_t *handle,
         return ext3_journal_get_write_access(handle, bh);
 }
 
+/*
+ * The idea of this helper function is following:
+ * if prepare_write has allocated some blocks, but not all of them, the
+ * transaction must include the content of the newly allocated blocks.
+ * This content is expected to be set to zeroes by block_prepare_write().
+ * 2006/10/14  SAW
+ */
+static int ext3_prepare_failure(struct file *file, struct page *page,
+                                unsigned from, unsigned to)
+{
+        struct address_space *mapping;
+        struct buffer_head *bh, *head, *next;
+        unsigned block_start, block_end;
+        unsigned blocksize;
+        int ret;
+        handle_t *handle = ext3_journal_current_handle();
+
+        mapping = page->mapping;
+        if (ext3_should_writeback_data(mapping->host)) {
+                /* optimization: no constraints about data */
+skip:
+                return ext3_journal_stop(handle);
+        }
+
+        head = page_buffers(page);
+        blocksize = head->b_size;
+        for (   bh = head, block_start = 0;
+                bh != head || !block_start;
+                block_start = block_end, bh = next)
+        {
+                next = bh->b_this_page;
+                block_end = block_start + blocksize;
+                if (block_end <= from)
+                        continue;
+                if (block_start >= to) {
+                        block_start = to;
+                        break;
+                }
+                if (!buffer_mapped(bh))
+                /* prepare_write failed on this bh */
+                        break;
+                if (ext3_should_journal_data(mapping->host)) {
+                        ret = do_journal_get_write_access(handle, bh);
+                        if (ret) {
+                                ext3_journal_stop(handle);
+                                return ret;
+                        }
+                }
+        /*
+         * block_start here becomes the first block where the current iteration
+         * of prepare_write failed.
+         */
+        }
+        if (block_start <= from)
+                goto skip;
+
+        /* commit allocated and zeroed buffers */
+        return mapping->a_ops->commit_write(file, page, from, block_start);
+}
+
 static int ext3_prepare_write(struct file *file, struct page *page,
                               unsigned from, unsigned to)
 {
         struct inode *inode = page->mapping->host;
-        int ret, needed_blocks = ext3_writepage_trans_blocks(inode);
+        int ret, ret2;
+        int needed_blocks = ext3_writepage_trans_blocks(inode);
         handle_t *handle;
         int retries = 0;
 
 retry:
         handle = ext3_journal_start(inode, needed_blocks);
-        if (IS_ERR(handle)) {
-                ret = PTR_ERR(handle);
-                goto out;
-        }
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
         if (test_opt(inode->i_sb, NOBH) && ext3_should_writeback_data(inode))
                 ret = nobh_prepare_write(page, from, to, ext3_get_block);
         else
                 ret = block_prepare_write(page, from, to, ext3_get_block);
         if (ret)
-                goto prepare_write_failed;
+                goto failure;
 
         if (ext3_should_journal_data(inode)) {
                 ret = walk_page_buffers(handle, page_buffers(page),
                                 from, to, NULL, do_journal_get_write_access);
+                if (ret)
+                        /* fatal error, just put the handle and return */
+                        journal_stop(handle);
         }
-prepare_write_failed:
-        if (ret)
-                ext3_journal_stop(handle);
+        return ret;
+
+failure:
+        ret2 = ext3_prepare_failure(file, page, from, to);
+        if (ret2 < 0)
+                return ret2;
         if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
                 goto retry;
-out:
+        /* retry number exceeded, or other error like -EDQUOT */
         return ret;
 }
 
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 906731a20f1a..60d2f9dbdb00 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -552,6 +552,15 @@ static int htree_dirblock_to_tree(struct file *dir_file,
                                            dir->i_sb->s_blocksize -
                                            EXT3_DIR_REC_LEN(0));
         for (; de < top; de = ext3_next_entry(de)) {
+                if (!ext3_check_dir_entry("htree_dirblock_to_tree", dir, de, bh,
+                                        (block<<EXT3_BLOCK_SIZE_BITS(dir->i_sb))
+                                                +((char *)de - bh->b_data))) {
+                        /* On error, skip the f_pos to the next block. */
+                        dir_file->f_pos = (dir_file->f_pos |
+                                        (dir->i_sb->s_blocksize - 1)) + 1;
+                        brelse (bh);
+                        return count;
+                }
                 ext3fs_dirhash(de->name, de->name_len, hinfo);
                 if ((hinfo->hash < start_hash) ||
                     ((hinfo->hash == start_hash) &&
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index afc2d4f42d77..580b8a6ca979 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -436,7 +436,7 @@ static void ext3_put_super (struct super_block * sb)
         return;
 }
 
-static kmem_cache_t *ext3_inode_cachep;
+static struct kmem_cache *ext3_inode_cachep;
 
 /*
  * Called inside transaction, so use GFP_NOFS
@@ -445,7 +445,7 @@ static struct inode *ext3_alloc_inode(struct super_block *sb)
 {
         struct ext3_inode_info *ei;
 
-        ei = kmem_cache_alloc(ext3_inode_cachep, SLAB_NOFS);
+        ei = kmem_cache_alloc(ext3_inode_cachep, GFP_NOFS);
         if (!ei)
                 return NULL;
 #ifdef CONFIG_EXT3_FS_POSIX_ACL
@@ -462,7 +462,7 @@ static void ext3_destroy_inode(struct inode *inode)
         kmem_cache_free(ext3_inode_cachep, EXT3_I(inode));
 }
 
-static void init_once(void * foo, kmem_cache_t * cachep, unsigned long flags)
+static void init_once(void * foo, struct kmem_cache * cachep, unsigned long flags)
 {
         struct ext3_inode_info *ei = (struct ext3_inode_info *) foo;
 
@@ -1264,6 +1264,12 @@ static void ext3_orphan_cleanup (struct super_block * sb,
                 return;
         }
 
+        if (bdev_read_only(sb->s_bdev)) {
+                printk(KERN_ERR "EXT3-fs: write access "
+                        "unavailable, skipping orphan cleanup.\n");
+                return;
+        }
+
         if (EXT3_SB(sb)->s_mount_state & EXT3_ERROR_FS) {
                 if (es->s_last_orphan)
                         jbd_debug(1, "Errors on filesystem, "
@@ -2387,6 +2393,7 @@ static int ext3_statfs (struct dentry * dentry, struct kstatfs * buf)
         struct ext3_super_block *es = sbi->s_es;
         ext3_fsblk_t overhead;
         int i;
+        u64 fsid;
 
         if (test_opt (sb, MINIX_DF))
                 overhead = 0;
@@ -2433,6 +2440,10 @@ static int ext3_statfs (struct dentry * dentry, struct kstatfs * buf)
         buf->f_files = le32_to_cpu(es->s_inodes_count);
         buf->f_ffree = percpu_counter_sum(&sbi->s_freeinodes_counter);
         buf->f_namelen = EXT3_NAME_LEN;
+        fsid = le64_to_cpup((void *)es->s_uuid) ^
+               le64_to_cpup((void *)es->s_uuid + sizeof(u64));
+        buf->f_fsid.val[0] = fsid & 0xFFFFFFFFUL;
+        buf->f_fsid.val[1] = (fsid >> 32) & 0xFFFFFFFFUL;
         return 0;
 }
 
diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
index f86f2482f01d..99857a400f4b 100644
--- a/fs/ext3/xattr.c
+++ b/fs/ext3/xattr.c
@@ -459,14 +459,11 @@ static void ext3_xattr_update_super_block(handle_t *handle,
         if (EXT3_HAS_COMPAT_FEATURE(sb, EXT3_FEATURE_COMPAT_EXT_ATTR))
                 return;
 
-        lock_super(sb);
         if (ext3_journal_get_write_access(handle, EXT3_SB(sb)->s_sbh) == 0) {
-                EXT3_SB(sb)->s_es->s_feature_compat |=
-                        cpu_to_le32(EXT3_FEATURE_COMPAT_EXT_ATTR);
+                EXT3_SET_COMPAT_FEATURE(sb, EXT3_FEATURE_COMPAT_EXT_ATTR);
                 sb->s_dirt = 1;
                 ext3_journal_dirty_metadata(handle, EXT3_SB(sb)->s_sbh);
         }
-        unlock_super(sb);
 }
 
 /*