jbd2: clear b_modified before moving the jh to a different transaction

jbd2_journal_forget() and jbd2_journal_invalidatepage() functions move buffer
to BJ_Forget list of a running transaction so that the buffer gets cleaned up
when the transaction is committed. This usually happens when underlying block
is freed but jbd2_journal_invalidatepage() can also move the buffer when page
cache of the corresponding inode (may be a block device) gets flushed.  When
the buffer had b_modfied set from the previous transaction and we happen to
modify it again in the current transaction, we won't properly account for the
modified buffer by subtracting the number of reserved credits of the running
transaction because do_get_write_access() won't clear b_modified (buffer
already is on running transaction so do_get_write_access() things it has
nothing to do).  This then results in assertion failure in commit code because
the transaction has more buffers than reserved credits (t_nr_buffers >
t_outstanding_credits).

We fix the issue by clearing b_modified before moving buffer to a BJ_Forget list
of another transaction because logically, it's not changed for that transaction
anymore.

CC: stable@kernel.org
Signed-off-by: Josef Bacik <josef@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>

diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index ddcd3549c6c26cbc9cb9dd46831b189ed3c0441e..70e118a7e9b29e2e3ac7799ba37432ed2280bbd4 100644 (file)
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1785,6 +1785,7 @@ static int __dispose_buffer(struct journal_head *jh, transaction_t *transaction)
                 * __journal_file_buffer
                 */
                clear_buffer_dirty(bh);
+               jh->b_modified = 0;
                __jbd2_journal_file_buffer(jh, transaction, BJ_Forget);
                may_free = 0;
        } else {
@@ -1946,8 +1947,10 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
                 * clear dirty bits when it is done with the buffer.
                 */
                set_buffer_freed(bh);
-               if (journal->j_running_transaction && buffer_jbddirty(bh))
+               if (journal->j_running_transaction && buffer_jbddirty(bh)) {
+                       jh->b_modified = 0;
                        jh->b_next_transaction = journal->j_running_transaction;
+               }
                jbd2_journal_put_journal_head(jh);
                spin_unlock(&journal->j_list_lock);
                jbd_unlock_bh_state(bh);