jbd: clear b_modified before moving the jh to a different transaction

journal_forget() and journal_invalidatepage() functions move buffer to
BJ_Forget list of a running transaction so that the buffer gets cleaned up when
the transaction is committed. This usually happens when underlying block is
freed but journal_invalidatepage() can also move the buffer when page cache of
the corresponding inode (may be a block device) gets flushed.  When the buffer
had b_modfied set from the previous transaction and we happen to modify it
again in the current transaction, we won't properly account for the modified
buffer by subtracting the number of reserved credits of the running transaction
because do_get_write_access() won't clear b_modified (buffer already is on
running transaction so do_get_write_access() things it has nothing to do).
This then results in assertion failure in commit code because the transaction
has more buffers than reserved credits (t_nr_buffers > t_outstanding_credits).

We fix the issue by clearing b_modified before moving buffer to a BJ_Forget list
of another transaction because logically, it's not changed for that transaction
anymore.

CC: stable@kernel.org
Signed-off-by: Josef Bacik <josef@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>

diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index febc10db5cedb8d26e40d2a894105f0af3547735..fb48e444c987aa14c9d0285653f94a937aa0f1e3 100644 (file)
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -1788,6 +1788,7 @@ static int __dispose_buffer(struct journal_head *jh, transaction_t *transaction)
                 */
                clear_buffer_dirty(bh);
                __journal_file_buffer(jh, transaction, BJ_Forget);
+               jh->b_modified = 0;
                may_free = 0;
        } else {
                JBUFFER_TRACE(jh, "on running transaction");
@@ -1956,8 +1957,10 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
                 * clear dirty bits when it is done with the buffer.
                 */
                set_buffer_freed(bh);
-               if (journal->j_running_transaction && buffer_jbddirty(bh))
+               if (journal->j_running_transaction && buffer_jbddirty(bh)) {
+                       jh->b_modified = 0;
                        jh->b_next_transaction = journal->j_running_transaction;
+               }
                journal_put_journal_head(jh);
                spin_unlock(&journal->j_list_lock);
                jbd_unlock_bh_state(bh);