6 files changed, 349 insertions, 12 deletions

diff --git a/fs/jbd2/Kconfig b/fs/jbd2/Kconfig
index f32f346f4b0a..69a48c2944da 100644
--- a/fs/jbd2/Kconfig
+++ b/fs/jbd2/Kconfig
@@ -1,6 +1,8 @@
 config JBD2
         tristate
         select CRC32
+        select CRYPTO
+        select CRYPTO_CRC32C
         help
           This is a generic journaling layer for block devices that support
           both 32-bit and 64-bit block numbers.  It is currently used by
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 840f70f50792..216f4299f65e 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -85,6 +85,24 @@ nope:
         __brelse(bh);
 }
 
+static void jbd2_commit_block_csum_set(journal_t *j,
+                                       struct journal_head *descriptor)
+{
+        struct commit_header *h;
+        __u32 csum;
+
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return;
+
+        h = (struct commit_header *)(jh2bh(descriptor)->b_data);
+        h->h_chksum_type = 0;
+        h->h_chksum_size = 0;
+        h->h_chksum[0] = 0;
+        csum = jbd2_chksum(j, j->j_csum_seed, jh2bh(descriptor)->b_data,
+                           j->j_blocksize);
+        h->h_chksum[0] = cpu_to_be32(csum);
+}
+
 /*
  * Done it all: now submit the commit record.  We should have
  * cleaned up our previous buffers by now, so if we are in abort
@@ -128,6 +146,7 @@ static int journal_submit_commit_record(journal_t *journal,
                 tmp->h_chksum_size      = JBD2_CRC32_CHKSUM_SIZE;
                 tmp->h_chksum[0]        = cpu_to_be32(crc32_sum);
         }
+        jbd2_commit_block_csum_set(journal, descriptor);
 
         JBUFFER_TRACE(descriptor, "submit commit block");
         lock_buffer(bh);
@@ -301,6 +320,44 @@ static void write_tag_block(int tag_bytes, journal_block_tag_t *tag,
                 tag->t_blocknr_high = cpu_to_be32((block >> 31) >> 1);
 }
 
+static void jbd2_descr_block_csum_set(journal_t *j,
+                                      struct journal_head *descriptor)
+{
+        struct jbd2_journal_block_tail *tail;
+        __u32 csum;
+
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return;
+
+        tail = (struct jbd2_journal_block_tail *)
+                        (jh2bh(descriptor)->b_data + j->j_blocksize -
+                        sizeof(struct jbd2_journal_block_tail));
+        tail->t_checksum = 0;
+        csum = jbd2_chksum(j, j->j_csum_seed, jh2bh(descriptor)->b_data,
+                           j->j_blocksize);
+        tail->t_checksum = cpu_to_be32(csum);
+}
+
+static void jbd2_block_tag_csum_set(journal_t *j, journal_block_tag_t *tag,
+                                    struct buffer_head *bh, __u32 sequence)
+{
+        struct page *page = bh->b_page;
+        __u8 *addr;
+        __u32 csum;
+
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return;
+
+        sequence = cpu_to_be32(sequence);
+        addr = kmap_atomic(page, KM_USER0);
+        csum = jbd2_chksum(j, j->j_csum_seed, (__u8 *)&sequence,
+                          sizeof(sequence));
+        csum = jbd2_chksum(j, csum, addr + offset_in_page(bh->b_data),
+                          bh->b_size);
+        kunmap_atomic(addr, KM_USER0);
+
+        tag->t_checksum = cpu_to_be32(csum);
+}
 /*
  * jbd2_journal_commit_transaction
  *
@@ -334,6 +391,10 @@ void jbd2_journal_commit_transaction(journal_t *journal)
         unsigned long first_block;
         tid_t first_tid;
         int update_tail;
+        int csum_size = 0;
+
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                csum_size = sizeof(struct jbd2_journal_block_tail);
 
         /*
          * First job: lock down the current transaction and wait for
@@ -627,7 +688,9 @@ void jbd2_journal_commit_transaction(journal_t *journal)
 
                 tag = (journal_block_tag_t *) tagp;
                 write_tag_block(tag_bytes, tag, jh2bh(jh)->b_blocknr);
-                tag->t_flags = cpu_to_be32(tag_flag);
+                tag->t_flags = cpu_to_be16(tag_flag);
+                jbd2_block_tag_csum_set(journal, tag, jh2bh(new_jh),
+                                        commit_transaction->t_tid);
                 tagp += tag_bytes;
                 space_left -= tag_bytes;
 
@@ -643,7 +706,7 @@ void jbd2_journal_commit_transaction(journal_t *journal)
 
                 if (bufs == journal->j_wbufsize ||
                     commit_transaction->t_buffers == NULL ||
-                    space_left < tag_bytes + 16) {
+                    space_left < tag_bytes + 16 + csum_size) {
 
                         jbd_debug(4, "JBD2: Submit %d IOs\n", bufs);
 
@@ -651,8 +714,9 @@ void jbd2_journal_commit_transaction(journal_t *journal)
                            submitting the IOs.  "tag" still points to
                            the last tag we set up. */
 
-                        tag->t_flags |= cpu_to_be32(JBD2_FLAG_LAST_TAG);
+                        tag->t_flags |= cpu_to_be16(JBD2_FLAG_LAST_TAG);
 
+                        jbd2_descr_block_csum_set(journal, descriptor);
 start_journal_io:
                         for (i = 0; i < bufs; i++) {
                                 struct buffer_head *bh = wbuf[i];
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 1afb701622b0..e9a3c4c85594 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -97,6 +97,43 @@ EXPORT_SYMBOL(jbd2_inode_cache);
 static void __journal_abort_soft (journal_t *journal, int errno);
 static int jbd2_journal_create_slab(size_t slab_size);
 
+/* Checksumming functions */
+int jbd2_verify_csum_type(journal_t *j, journal_superblock_t *sb)
+{
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return 1;
+
+        return sb->s_checksum_type == JBD2_CRC32C_CHKSUM;
+}
+
+static __u32 jbd2_superblock_csum(journal_t *j, journal_superblock_t *sb)
+{
+        __u32 csum, old_csum;
+
+        old_csum = sb->s_checksum;
+        sb->s_checksum = 0;
+        csum = jbd2_chksum(j, ~0, (char *)sb, sizeof(journal_superblock_t));
+        sb->s_checksum = old_csum;
+
+        return cpu_to_be32(csum);
+}
+
+int jbd2_superblock_csum_verify(journal_t *j, journal_superblock_t *sb)
+{
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return 1;
+
+        return sb->s_checksum == jbd2_superblock_csum(j, sb);
+}
+
+void jbd2_superblock_csum_set(journal_t *j, journal_superblock_t *sb)
+{
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return;
+
+        sb->s_checksum = jbd2_superblock_csum(j, sb);
+}
+
 /*
  * Helper function used to manage commit timeouts
  */
@@ -1348,6 +1385,7 @@ static void jbd2_journal_update_sb_errno(journal_t *journal)
         jbd_debug(1, "JBD2: updating superblock error (errno %d)\n",
                   journal->j_errno);
         sb->s_errno    = cpu_to_be32(journal->j_errno);
+        jbd2_superblock_csum_set(journal, sb);
         read_unlock(&journal->j_state_lock);
 
         jbd2_write_superblock(journal, WRITE_SYNC);
@@ -1376,6 +1414,9 @@ static int journal_get_superblock(journal_t *journal)
                 }
         }
 
+        if (buffer_verified(bh))
+                return 0;
+
         sb = journal->j_superblock;
 
         err = -EINVAL;
@@ -1413,6 +1454,43 @@ static int journal_get_superblock(journal_t *journal)
                 goto out;
         }
 
+        if (JBD2_HAS_COMPAT_FEATURE(journal, JBD2_FEATURE_COMPAT_CHECKSUM) &&
+            JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
+                /* Can't have checksum v1 and v2 on at the same time! */
+                printk(KERN_ERR "JBD: Can't enable checksumming v1 and v2 "
+                       "at the same time!\n");
+                goto out;
+        }
+
+        if (!jbd2_verify_csum_type(journal, sb)) {
+                printk(KERN_ERR "JBD: Unknown checksum type\n");
+                goto out;
+        }
+
+        /* Load the checksum driver */
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
+                journal->j_chksum_driver = crypto_alloc_shash("crc32c", 0, 0);
+                if (IS_ERR(journal->j_chksum_driver)) {
+                        printk(KERN_ERR "JBD: Cannot load crc32c driver.\n");
+                        err = PTR_ERR(journal->j_chksum_driver);
+                        journal->j_chksum_driver = NULL;
+                        goto out;
+                }
+        }
+
+        /* Check superblock checksum */
+        if (!jbd2_superblock_csum_verify(journal, sb)) {
+                printk(KERN_ERR "JBD: journal checksum error\n");
+                goto out;
+        }
+
+        /* Precompute checksum seed for all metadata */
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                journal->j_csum_seed = jbd2_chksum(journal, ~0, sb->s_uuid,
+                                                   sizeof(sb->s_uuid));
+
+        set_buffer_verified(bh);
+
         return 0;
 
 out:
@@ -1564,6 +1642,8 @@ int jbd2_journal_destroy(journal_t *journal)
                 iput(journal->j_inode);
         if (journal->j_revoke)
                 jbd2_journal_destroy_revoke(journal);
+        if (journal->j_chksum_driver)
+                crypto_free_shash(journal->j_chksum_driver);
         kfree(journal->j_wbuf);
         kfree(journal);
 
@@ -1653,6 +1733,10 @@ int jbd2_journal_check_available_features (journal_t *journal, unsigned long com
 int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
                           unsigned long ro, unsigned long incompat)
 {
+#define INCOMPAT_FEATURE_ON(f) \
+                ((incompat & (f)) && !(sb->s_feature_incompat & cpu_to_be32(f)))
+#define COMPAT_FEATURE_ON(f) \
+                ((compat & (f)) && !(sb->s_feature_compat & cpu_to_be32(f)))
         journal_superblock_t *sb;
 
         if (jbd2_journal_check_used_features(journal, compat, ro, incompat))
@@ -1661,16 +1745,54 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
         if (!jbd2_journal_check_available_features(journal, compat, ro, incompat))
                 return 0;
 
+        /* Asking for checksumming v2 and v1?  Only give them v2. */
+        if (incompat & JBD2_FEATURE_INCOMPAT_CSUM_V2 &&
+            compat & JBD2_FEATURE_COMPAT_CHECKSUM)
+                compat &= ~JBD2_FEATURE_COMPAT_CHECKSUM;
+
         jbd_debug(1, "Setting new features 0x%lx/0x%lx/0x%lx\n",
                   compat, ro, incompat);
 
         sb = journal->j_superblock;
 
+        /* If enabling v2 checksums, update superblock */
+        if (INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
+                sb->s_checksum_type = JBD2_CRC32C_CHKSUM;
+                sb->s_feature_compat &=
+                        ~cpu_to_be32(JBD2_FEATURE_COMPAT_CHECKSUM);
+
+                /* Load the checksum driver */
+                if (journal->j_chksum_driver == NULL) {
+                        journal->j_chksum_driver = crypto_alloc_shash("crc32c",
+                                                                      0, 0);
+                        if (IS_ERR(journal->j_chksum_driver)) {
+                                printk(KERN_ERR "JBD: Cannot load crc32c "
+                                       "driver.\n");
+                                journal->j_chksum_driver = NULL;
+                                return 0;
+                        }
+                }
+
+                /* Precompute checksum seed for all metadata */
+                if (JBD2_HAS_INCOMPAT_FEATURE(journal,
+                                              JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                        journal->j_csum_seed = jbd2_chksum(journal, ~0,
+                                                           sb->s_uuid,
+                                                           sizeof(sb->s_uuid));
+        }
+
+        /* If enabling v1 checksums, downgrade superblock */
+        if (COMPAT_FEATURE_ON(JBD2_FEATURE_COMPAT_CHECKSUM))
+                sb->s_feature_incompat &=
+                        ~cpu_to_be32(JBD2_FEATURE_INCOMPAT_CSUM_V2);
+
         sb->s_feature_compat    |= cpu_to_be32(compat);
         sb->s_feature_ro_compat |= cpu_to_be32(ro);
         sb->s_feature_incompat  |= cpu_to_be32(incompat);
 
         return 1;
+#undef COMPAT_FEATURE_ON
+#undef INCOMPAT_FEATURE_ON
 }
 
 /*
@@ -1975,10 +2097,16 @@ int jbd2_journal_blocks_per_page(struct inode *inode)
  */
 size_t journal_tag_bytes(journal_t *journal)
 {
+        journal_block_tag_t tag;
+        size_t x = 0;
+
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                x += sizeof(tag.t_checksum);
+
         if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
-                return JBD2_TAG_SIZE64;
+                return x + JBD2_TAG_SIZE64;
         else
-                return JBD2_TAG_SIZE32;
+                return x + JBD2_TAG_SIZE32;
 }
 
 /*
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index c1a03354a22f..0131e4362534 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -174,6 +174,25 @@ static int jread(struct buffer_head **bhp, journal_t *journal,
         return 0;
 }
 
+static int jbd2_descr_block_csum_verify(journal_t *j,
+                                        void *buf)
+{
+        struct jbd2_journal_block_tail *tail;
+        __u32 provided, calculated;
+
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return 1;
+
+        tail = (struct jbd2_journal_block_tail *)(buf + j->j_blocksize -
+                        sizeof(struct jbd2_journal_block_tail));
+        provided = tail->t_checksum;
+        tail->t_checksum = 0;
+        calculated = jbd2_chksum(j, j->j_csum_seed, buf, j->j_blocksize);
+        tail->t_checksum = provided;
+
+        provided = be32_to_cpu(provided);
+        return provided == calculated;
+}
 
 /*
  * Count the number of in-use tags in a journal descriptor block.
@@ -186,6 +205,9 @@ static int count_tags(journal_t *journal, struct buffer_head *bh)
         int                     nr = 0, size = journal->j_blocksize;
         int                     tag_bytes = journal_tag_bytes(journal);
 
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                size -= sizeof(struct jbd2_journal_block_tail);
+
         tagp = &bh->b_data[sizeof(journal_header_t)];
 
         while ((tagp - bh->b_data + tag_bytes) <= size) {
@@ -193,10 +215,10 @@ static int count_tags(journal_t *journal, struct buffer_head *bh)
 
                 nr++;
                 tagp += tag_bytes;
-                if (!(tag->t_flags & cpu_to_be32(JBD2_FLAG_SAME_UUID)))
+                if (!(tag->t_flags & cpu_to_be16(JBD2_FLAG_SAME_UUID)))
                         tagp += 16;
 
-                if (tag->t_flags & cpu_to_be32(JBD2_FLAG_LAST_TAG))
+                if (tag->t_flags & cpu_to_be16(JBD2_FLAG_LAST_TAG))
                         break;
         }
 
@@ -353,6 +375,41 @@ static int calc_chksums(journal_t *journal, struct buffer_head *bh,
         return 0;
 }
 
+static int jbd2_commit_block_csum_verify(journal_t *j, void *buf)
+{
+        struct commit_header *h;
+        __u32 provided, calculated;
+
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return 1;
+
+        h = buf;
+        provided = h->h_chksum[0];
+        h->h_chksum[0] = 0;
+        calculated = jbd2_chksum(j, j->j_csum_seed, buf, j->j_blocksize);
+        h->h_chksum[0] = provided;
+
+        provided = be32_to_cpu(provided);
+        return provided == calculated;
+}
+
+static int jbd2_block_tag_csum_verify(journal_t *j, journal_block_tag_t *tag,
+                                      void *buf, __u32 sequence)
+{
+        __u32 provided, calculated;
+
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return 1;
+
+        sequence = cpu_to_be32(sequence);
+        calculated = jbd2_chksum(j, j->j_csum_seed, (__u8 *)&sequence,
+                                 sizeof(sequence));
+        calculated = jbd2_chksum(j, calculated, buf, j->j_blocksize);
+        provided = be32_to_cpu(tag->t_checksum);
+
+        return provided == cpu_to_be32(calculated);
+}
+
 static int do_one_pass(journal_t *journal,
                         struct recovery_info *info, enum passtype pass)
 {
@@ -366,6 +423,7 @@ static int do_one_pass(journal_t *journal,
         int                     blocktype;
         int                     tag_bytes = journal_tag_bytes(journal);
         __u32                   crc32_sum = ~0; /* Transactional Checksums */
+        int                     descr_csum_size = 0;
 
         /*
          * First thing is to establish what we expect to find in the log
@@ -451,6 +509,18 @@ static int do_one_pass(journal_t *journal,
 
                 switch(blocktype) {
                 case JBD2_DESCRIPTOR_BLOCK:
+                        /* Verify checksum first */
+                        if (JBD2_HAS_INCOMPAT_FEATURE(journal,
+                                        JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                                descr_csum_size =
+                                        sizeof(struct jbd2_journal_block_tail);
+                        if (descr_csum_size > 0 &&
+                            !jbd2_descr_block_csum_verify(journal,
+                                                          bh->b_data)) {
+                                err = -EIO;
+                                goto failed;
+                        }
+
                         /* If it is a valid descriptor block, replay it
                          * in pass REPLAY; if journal_checksums enabled, then
                          * calculate checksums in PASS_SCAN, otherwise,
@@ -481,11 +551,11 @@ static int do_one_pass(journal_t *journal,
 
                         tagp = &bh->b_data[sizeof(journal_header_t)];
                         while ((tagp - bh->b_data + tag_bytes)
-                               <= journal->j_blocksize) {
+                               <= journal->j_blocksize - descr_csum_size) {
                                 unsigned long io_block;
 
                                 tag = (journal_block_tag_t *) tagp;
-                                flags = be32_to_cpu(tag->t_flags);
+                                flags = be16_to_cpu(tag->t_flags);
 
                                 io_block = next_log_block++;
                                 wrap(journal, next_log_block);
@@ -516,6 +586,19 @@ static int do_one_pass(journal_t *journal,
                                                 goto skip_write;
                                         }
 
+                                        /* Look for block corruption */
+                                        if (!jbd2_block_tag_csum_verify(
+                                                journal, tag, obh->b_data,
+                                                be32_to_cpu(tmp->h_sequence))) {
+                                                brelse(obh);
+                                                success = -EIO;
+                                                printk(KERN_ERR "JBD: Invalid "
+                                                       "checksum recovering "
+                                                       "block %llu in log\n",
+                                                       blocknr);
+                                                continue;
+                                        }
+
                                         /* Find a buffer for the new
                                          * data being restored */
                                         nbh = __getblk(journal->j_fs_dev,
@@ -650,6 +733,19 @@ static int do_one_pass(journal_t *journal,
                                 }
                                 crc32_sum = ~0;
                         }
+                        if (pass == PASS_SCAN &&
+                            !jbd2_commit_block_csum_verify(journal,
+                                                           bh->b_data)) {
+                                info->end_transaction = next_commit_ID;
+
+                                if (!JBD2_HAS_INCOMPAT_FEATURE(journal,
+                                     JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT)) {
+                                        journal->j_failed_commit =
+                                                next_commit_ID;
+                                        brelse(bh);
+                                        break;
+                                }
+                        }
                         brelse(bh);
                         next_commit_ID++;
                         continue;
@@ -706,6 +802,25 @@ static int do_one_pass(journal_t *journal,
         return err;
 }
 
+static int jbd2_revoke_block_csum_verify(journal_t *j,
+                                         void *buf)
+{
+        struct jbd2_journal_revoke_tail *tail;
+        __u32 provided, calculated;
+
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return 1;
+
+        tail = (struct jbd2_journal_revoke_tail *)(buf + j->j_blocksize -
+                        sizeof(struct jbd2_journal_revoke_tail));
+        provided = tail->r_checksum;
+        tail->r_checksum = 0;
+        calculated = jbd2_chksum(j, j->j_csum_seed, buf, j->j_blocksize);
+        tail->r_checksum = provided;
+
+        provided = be32_to_cpu(provided);
+        return provided == calculated;
+}
 
 /* Scan a revoke record, marking all blocks mentioned as revoked. */
 
@@ -720,6 +835,9 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh,
         offset = sizeof(jbd2_journal_revoke_header_t);
         max = be32_to_cpu(header->r_count);
 
+        if (!jbd2_revoke_block_csum_verify(journal, header))
+                return -EINVAL;
+
         if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
                 record_len = 8;
 
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index 6973705d6a3d..f30b80b4ce8b 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -578,6 +578,7 @@ static void write_one_revoke_record(journal_t *journal,
                                     struct jbd2_revoke_record_s *record,
                                     int write_op)
 {
+        int csum_size = 0;
         struct journal_head *descriptor;
         int offset;
         journal_header_t *header;
@@ -592,9 +593,13 @@ static void write_one_revoke_record(journal_t *journal,
         descriptor = *descriptorp;
         offset = *offsetp;
 
+        /* Do we need to leave space at the end for a checksum? */
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                csum_size = sizeof(struct jbd2_journal_revoke_tail);
+
         /* Make sure we have a descriptor with space left for the record */
         if (descriptor) {
-                if (offset == journal->j_blocksize) {
+                if (offset >= journal->j_blocksize - csum_size) {
                         flush_descriptor(journal, descriptor, offset, write_op);
                         descriptor = NULL;
                 }
@@ -631,6 +636,24 @@ static void write_one_revoke_record(journal_t *journal,
         *offsetp = offset;
 }
 
+static void jbd2_revoke_csum_set(journal_t *j,
+                                 struct journal_head *descriptor)
+{
+        struct jbd2_journal_revoke_tail *tail;
+        __u32 csum;
+
+        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                return;
+
+        tail = (struct jbd2_journal_revoke_tail *)
+                        (jh2bh(descriptor)->b_data + j->j_blocksize -
+                        sizeof(struct jbd2_journal_revoke_tail));
+        tail->r_checksum = 0;
+        csum = jbd2_chksum(j, j->j_csum_seed, jh2bh(descriptor)->b_data,
+                           j->j_blocksize);
+        tail->r_checksum = cpu_to_be32(csum);
+}
+
 /*
  * Flush a revoke descriptor out to the journal.  If we are aborting,
  * this is a noop; otherwise we are generating a buffer which needs to
@@ -652,6 +675,8 @@ static void flush_descriptor(journal_t *journal,
 
         header = (jbd2_journal_revoke_header_t *) jh2bh(descriptor)->b_data;
         header->r_count = cpu_to_be32(offset);
+        jbd2_revoke_csum_set(journal, descriptor);
+
         set_buffer_jwrite(bh);
         BUFFER_TRACE(bh, "write");
         set_buffer_dirty(bh);
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index ddcd3549c6c2..fb1ab9533b67 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -162,8 +162,8 @@ static int start_this_handle(journal_t *journal, handle_t *handle,
 
 alloc_transaction:
         if (!journal->j_running_transaction) {
-                new_transaction = kmem_cache_alloc(transaction_cache,
-                                                   gfp_mask | __GFP_ZERO);
+                new_transaction = kmem_cache_zalloc(transaction_cache,
+                                                    gfp_mask);
                 if (!new_transaction) {
                         /*
                          * If __GFP_FS is not present, then we may be