search for: btrfs_copy_from_user

This problem is found in meego testing: http://bugs.meego.com/show_bug.cgi?id=6672 A file in btrfs is mmaped and the mmaped buffer is passed to pwrite to write to the same page of the same file. In btrfs_file_aio_write(), the pages is locked by prepare_pages(). So when btrfs_copy_from_user() is called, page fault happens and the same page needs to be locked again in filemap_fault(). The fix is to move iov_iter_fault_in_readable() before prepage_pages() to make page fault happen before pages are locked. And also disable page fault in critical region in btrfs_copy_from_user(). Signed-...

...ernel: [ 524.496006] Call Trace: Feb 10 10:59:45 testbox kernel: [ 524.496006] [<c04268aa>] __kmap_atomic+0x13/0x15 Feb 10 10:59:45 testbox kernel: [ 524.496006] [<c04ab3cd>] iov_iter_copy_from_user_atomic+0x28/0x6c Feb 10 10:59:45 testbox kernel: [ 524.496006] [<f8217b41>] btrfs_copy_from_user.isra.6+0x5c/0x96 [btrfs] Feb 10 10:59:45 testbox kernel: [ 524.496006] [<f8218129>] btrfs_file_aio_write+0x480/0x79b [btrfs] Feb 10 10:59:45 testbox kernel: [ 524.496006] [<c04dd8e4>] ? mem_cgroup_update_page_stat+0x1a/0xd4 Feb 10 10:59:45 testbox kernel: [ 524.496006] [<c04e3e...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All, I believe that I can pretty reliably reproduce the BUG mentioned in the attached dmesg output. (This doesn''t mean that you can, but I''ll detail what I''ve done here.) [This BUG is the same one that I reported last night.] 1) Create a 2 GB dynamically expanding disk. 2) Attach it to a VirtualBox machine. 3) Start the

...Trace: > Jan 6 20:06:23 eser kernel: [19365.563014] [<c022998e>] ? > __kmap_atomic+0xe/0x10 > Jan 6 20:06:23 eser kernel: [19365.563014] [<c0299c0c>] ? > iov_iter_copy_from_user_atomic+0x3c/0x90 > Jan 6 20:06:23 eser kernel: [19365.563014] [<f828d6da>] ? > btrfs_copy_from_user+0x5a/0xb0 [btrfs] > Jan 6 20:06:23 eser kernel: [19365.563014] [<f828e1ff>] ? > btrfs_file_aio_write+0x52f/0x9c0 [btrfs] > Jan 6 20:06:23 eser kernel: [19365.563014] [<c02d0810>] ? > __mem_cgroup_commit_charge+0x70/0xe0 > Jan 6 20:06:23 eser kernel: [19365.563014] [...

...endif + +#endif /* _COMPAT_H_ */ - --- a/file.c 2008-02-06 11:37:39.000000000 -0500 +++ b/file.c 2008-02-06 16:46:23.000000000 -0500 @@ -37,6 +37,7 @@ #include "ordered-data.h" #include "ioctl.h" #include "print-tree.h" +#include "compat.h" static int btrfs_copy_from_user(loff_t pos, int num_pages, int write_bytes, @@ -790,7 +791,11 @@ static ssize_t btrfs_file_write(struct f goto out_nolock; if (count == 0) goto out_nolock; +#ifdef REMOVE_SUID_PATH + err = remove_suid(&file->f_path); +#else err = remove_suid(fdentry(file)); +#endif if (err) go...

V1->V2: Check to see if our current ppos is >= i_size after a short DIO read, just in case it was actually a short read and we need to just return. This is similar to what already happens in the write case. If we have a short read while doing O_DIRECT, instead of just returning, fallthrough and try to read the rest via buffered IO. BTRFS needs this because if we encounter a compressed or