[PATCH] double-free of inode on alloc_file() failure exit in create_write_pipe()
[linux-2.6] / fs / jbd / commit.c
1 /*
2  * linux/fs/jbd/commit.c
3  *
4  * Written by Stephen C. Tweedie <sct@redhat.com>, 1998
5  *
6  * Copyright 1998 Red Hat corp --- All Rights Reserved
7  *
8  * This file is part of the Linux kernel and is made available under
9  * the terms of the GNU General Public License, version 2, or at your
10  * option, any later version, incorporated herein by reference.
11  *
12  * Journal commit routines for the generic filesystem journaling code;
13  * part of the ext2fs journaling system.
14  */
15
16 #include <linux/time.h>
17 #include <linux/fs.h>
18 #include <linux/jbd.h>
19 #include <linux/errno.h>
20 #include <linux/slab.h>
21 #include <linux/mm.h>
22 #include <linux/pagemap.h>
23
24 /*
25  * Default IO end handler for temporary BJ_IO buffer_heads.
26  */
27 static void journal_end_buffer_io_sync(struct buffer_head *bh, int uptodate)
28 {
29         BUFFER_TRACE(bh, "");
30         if (uptodate)
31                 set_buffer_uptodate(bh);
32         else
33                 clear_buffer_uptodate(bh);
34         unlock_buffer(bh);
35 }
36
37 /*
38  * When an ext3-ordered file is truncated, it is possible that many pages are
39  * not sucessfully freed, because they are attached to a committing transaction.
40  * After the transaction commits, these pages are left on the LRU, with no
41  * ->mapping, and with attached buffers.  These pages are trivially reclaimable
42  * by the VM, but their apparent absence upsets the VM accounting, and it makes
43  * the numbers in /proc/meminfo look odd.
44  *
45  * So here, we have a buffer which has just come off the forget list.  Look to
46  * see if we can strip all buffers from the backing page.
47  *
48  * Called under lock_journal(), and possibly under journal_datalist_lock.  The
49  * caller provided us with a ref against the buffer, and we drop that here.
50  */
51 static void release_buffer_page(struct buffer_head *bh)
52 {
53         struct page *page;
54
55         if (buffer_dirty(bh))
56                 goto nope;
57         if (atomic_read(&bh->b_count) != 1)
58                 goto nope;
59         page = bh->b_page;
60         if (!page)
61                 goto nope;
62         if (page->mapping)
63                 goto nope;
64
65         /* OK, it's a truncated page */
66         if (TestSetPageLocked(page))
67                 goto nope;
68
69         page_cache_get(page);
70         __brelse(bh);
71         try_to_free_buffers(page);
72         unlock_page(page);
73         page_cache_release(page);
74         return;
75
76 nope:
77         __brelse(bh);
78 }
79
80 /*
81  * Try to acquire jbd_lock_bh_state() against the buffer, when j_list_lock is
82  * held.  For ranking reasons we must trylock.  If we lose, schedule away and
83  * return 0.  j_list_lock is dropped in this case.
84  */
85 static int inverted_lock(journal_t *journal, struct buffer_head *bh)
86 {
87         if (!jbd_trylock_bh_state(bh)) {
88                 spin_unlock(&journal->j_list_lock);
89                 schedule();
90                 return 0;
91         }
92         return 1;
93 }
94
95 /* Done it all: now write the commit record.  We should have
96  * cleaned up our previous buffers by now, so if we are in abort
97  * mode we can now just skip the rest of the journal write
98  * entirely.
99  *
100  * Returns 1 if the journal needs to be aborted or 0 on success
101  */
102 static int journal_write_commit_record(journal_t *journal,
103                                         transaction_t *commit_transaction)
104 {
105         struct journal_head *descriptor;
106         struct buffer_head *bh;
107         journal_header_t *header;
108         int ret;
109         int barrier_done = 0;
110
111         if (is_journal_aborted(journal))
112                 return 0;
113
114         descriptor = journal_get_descriptor_buffer(journal);
115         if (!descriptor)
116                 return 1;
117
118         bh = jh2bh(descriptor);
119
120         header = (journal_header_t *)(bh->b_data);
121         header->h_magic = cpu_to_be32(JFS_MAGIC_NUMBER);
122         header->h_blocktype = cpu_to_be32(JFS_COMMIT_BLOCK);
123         header->h_sequence = cpu_to_be32(commit_transaction->t_tid);
124
125         JBUFFER_TRACE(descriptor, "write commit block");
126         set_buffer_dirty(bh);
127         if (journal->j_flags & JFS_BARRIER) {
128                 set_buffer_ordered(bh);
129                 barrier_done = 1;
130         }
131         ret = sync_dirty_buffer(bh);
132         if (barrier_done)
133                 clear_buffer_ordered(bh);
134         /* is it possible for another commit to fail at roughly
135          * the same time as this one?  If so, we don't want to
136          * trust the barrier flag in the super, but instead want
137          * to remember if we sent a barrier request
138          */
139         if (ret == -EOPNOTSUPP && barrier_done) {
140                 char b[BDEVNAME_SIZE];
141
142                 printk(KERN_WARNING
143                         "JBD: barrier-based sync failed on %s - "
144                         "disabling barriers\n",
145                         bdevname(journal->j_dev, b));
146                 spin_lock(&journal->j_state_lock);
147                 journal->j_flags &= ~JFS_BARRIER;
148                 spin_unlock(&journal->j_state_lock);
149
150                 /* And try again, without the barrier */
151                 set_buffer_uptodate(bh);
152                 set_buffer_dirty(bh);
153                 ret = sync_dirty_buffer(bh);
154         }
155         put_bh(bh);             /* One for getblk() */
156         journal_put_journal_head(descriptor);
157
158         return (ret == -EIO);
159 }
160
161 static void journal_do_submit_data(struct buffer_head **wbuf, int bufs)
162 {
163         int i;
164
165         for (i = 0; i < bufs; i++) {
166                 wbuf[i]->b_end_io = end_buffer_write_sync;
167                 /* We use-up our safety reference in submit_bh() */
168                 submit_bh(WRITE, wbuf[i]);
169         }
170 }
171
172 /*
173  *  Submit all the data buffers to disk
174  */
175 static void journal_submit_data_buffers(journal_t *journal,
176                                 transaction_t *commit_transaction)
177 {
178         struct journal_head *jh;
179         struct buffer_head *bh;
180         int locked;
181         int bufs = 0;
182         struct buffer_head **wbuf = journal->j_wbuf;
183
184         /*
185          * Whenever we unlock the journal and sleep, things can get added
186          * onto ->t_sync_datalist, so we have to keep looping back to
187          * write_out_data until we *know* that the list is empty.
188          *
189          * Cleanup any flushed data buffers from the data list.  Even in
190          * abort mode, we want to flush this out as soon as possible.
191          */
192 write_out_data:
193         cond_resched();
194         spin_lock(&journal->j_list_lock);
195
196         while (commit_transaction->t_sync_datalist) {
197                 jh = commit_transaction->t_sync_datalist;
198                 bh = jh2bh(jh);
199                 locked = 0;
200
201                 /* Get reference just to make sure buffer does not disappear
202                  * when we are forced to drop various locks */
203                 get_bh(bh);
204                 /* If the buffer is dirty, we need to submit IO and hence
205                  * we need the buffer lock. We try to lock the buffer without
206                  * blocking. If we fail, we need to drop j_list_lock and do
207                  * blocking lock_buffer().
208                  */
209                 if (buffer_dirty(bh)) {
210                         if (test_set_buffer_locked(bh)) {
211                                 BUFFER_TRACE(bh, "needs blocking lock");
212                                 spin_unlock(&journal->j_list_lock);
213                                 /* Write out all data to prevent deadlocks */
214                                 journal_do_submit_data(wbuf, bufs);
215                                 bufs = 0;
216                                 lock_buffer(bh);
217                                 spin_lock(&journal->j_list_lock);
218                         }
219                         locked = 1;
220                 }
221                 /* We have to get bh_state lock. Again out of order, sigh. */
222                 if (!inverted_lock(journal, bh)) {
223                         jbd_lock_bh_state(bh);
224                         spin_lock(&journal->j_list_lock);
225                 }
226                 /* Someone already cleaned up the buffer? */
227                 if (!buffer_jbd(bh)
228                         || jh->b_transaction != commit_transaction
229                         || jh->b_jlist != BJ_SyncData) {
230                         jbd_unlock_bh_state(bh);
231                         if (locked)
232                                 unlock_buffer(bh);
233                         BUFFER_TRACE(bh, "already cleaned up");
234                         put_bh(bh);
235                         continue;
236                 }
237                 if (locked && test_clear_buffer_dirty(bh)) {
238                         BUFFER_TRACE(bh, "needs writeout, adding to array");
239                         wbuf[bufs++] = bh;
240                         __journal_file_buffer(jh, commit_transaction,
241                                                 BJ_Locked);
242                         jbd_unlock_bh_state(bh);
243                         if (bufs == journal->j_wbufsize) {
244                                 spin_unlock(&journal->j_list_lock);
245                                 journal_do_submit_data(wbuf, bufs);
246                                 bufs = 0;
247                                 goto write_out_data;
248                         }
249                 } else if (!locked && buffer_locked(bh)) {
250                         __journal_file_buffer(jh, commit_transaction,
251                                                 BJ_Locked);
252                         jbd_unlock_bh_state(bh);
253                         put_bh(bh);
254                 } else {
255                         BUFFER_TRACE(bh, "writeout complete: unfile");
256                         __journal_unfile_buffer(jh);
257                         jbd_unlock_bh_state(bh);
258                         if (locked)
259                                 unlock_buffer(bh);
260                         journal_remove_journal_head(bh);
261                         /* Once for our safety reference, once for
262                          * journal_remove_journal_head() */
263                         put_bh(bh);
264                         put_bh(bh);
265                 }
266
267                 if (need_resched() || spin_needbreak(&journal->j_list_lock)) {
268                         spin_unlock(&journal->j_list_lock);
269                         goto write_out_data;
270                 }
271         }
272         spin_unlock(&journal->j_list_lock);
273         journal_do_submit_data(wbuf, bufs);
274 }
275
276 /*
277  * journal_commit_transaction
278  *
279  * The primary function for committing a transaction to the log.  This
280  * function is called by the journal thread to begin a complete commit.
281  */
282 void journal_commit_transaction(journal_t *journal)
283 {
284         transaction_t *commit_transaction;
285         struct journal_head *jh, *new_jh, *descriptor;
286         struct buffer_head **wbuf = journal->j_wbuf;
287         int bufs;
288         int flags;
289         int err;
290         unsigned long blocknr;
291         char *tagp = NULL;
292         journal_header_t *header;
293         journal_block_tag_t *tag = NULL;
294         int space_left = 0;
295         int first_tag = 0;
296         int tag_flag;
297         int i;
298
299         /*
300          * First job: lock down the current transaction and wait for
301          * all outstanding updates to complete.
302          */
303
304 #ifdef COMMIT_STATS
305         spin_lock(&journal->j_list_lock);
306         summarise_journal_usage(journal);
307         spin_unlock(&journal->j_list_lock);
308 #endif
309
310         /* Do we need to erase the effects of a prior journal_flush? */
311         if (journal->j_flags & JFS_FLUSHED) {
312                 jbd_debug(3, "super block updated\n");
313                 journal_update_superblock(journal, 1);
314         } else {
315                 jbd_debug(3, "superblock not updated\n");
316         }
317
318         J_ASSERT(journal->j_running_transaction != NULL);
319         J_ASSERT(journal->j_committing_transaction == NULL);
320
321         commit_transaction = journal->j_running_transaction;
322         J_ASSERT(commit_transaction->t_state == T_RUNNING);
323
324         jbd_debug(1, "JBD: starting commit of transaction %d\n",
325                         commit_transaction->t_tid);
326
327         spin_lock(&journal->j_state_lock);
328         commit_transaction->t_state = T_LOCKED;
329
330         spin_lock(&commit_transaction->t_handle_lock);
331         while (commit_transaction->t_updates) {
332                 DEFINE_WAIT(wait);
333
334                 prepare_to_wait(&journal->j_wait_updates, &wait,
335                                         TASK_UNINTERRUPTIBLE);
336                 if (commit_transaction->t_updates) {
337                         spin_unlock(&commit_transaction->t_handle_lock);
338                         spin_unlock(&journal->j_state_lock);
339                         schedule();
340                         spin_lock(&journal->j_state_lock);
341                         spin_lock(&commit_transaction->t_handle_lock);
342                 }
343                 finish_wait(&journal->j_wait_updates, &wait);
344         }
345         spin_unlock(&commit_transaction->t_handle_lock);
346
347         J_ASSERT (commit_transaction->t_outstanding_credits <=
348                         journal->j_max_transaction_buffers);
349
350         /*
351          * First thing we are allowed to do is to discard any remaining
352          * BJ_Reserved buffers.  Note, it is _not_ permissible to assume
353          * that there are no such buffers: if a large filesystem
354          * operation like a truncate needs to split itself over multiple
355          * transactions, then it may try to do a journal_restart() while
356          * there are still BJ_Reserved buffers outstanding.  These must
357          * be released cleanly from the current transaction.
358          *
359          * In this case, the filesystem must still reserve write access
360          * again before modifying the buffer in the new transaction, but
361          * we do not require it to remember exactly which old buffers it
362          * has reserved.  This is consistent with the existing behaviour
363          * that multiple journal_get_write_access() calls to the same
364          * buffer are perfectly permissable.
365          */
366         while (commit_transaction->t_reserved_list) {
367                 jh = commit_transaction->t_reserved_list;
368                 JBUFFER_TRACE(jh, "reserved, unused: refile");
369                 /*
370                  * A journal_get_undo_access()+journal_release_buffer() may
371                  * leave undo-committed data.
372                  */
373                 if (jh->b_committed_data) {
374                         struct buffer_head *bh = jh2bh(jh);
375
376                         jbd_lock_bh_state(bh);
377                         jbd_free(jh->b_committed_data, bh->b_size);
378                         jh->b_committed_data = NULL;
379                         jbd_unlock_bh_state(bh);
380                 }
381                 journal_refile_buffer(journal, jh);
382         }
383
384         /*
385          * Now try to drop any written-back buffers from the journal's
386          * checkpoint lists.  We do this *before* commit because it potentially
387          * frees some memory
388          */
389         spin_lock(&journal->j_list_lock);
390         __journal_clean_checkpoint_list(journal);
391         spin_unlock(&journal->j_list_lock);
392
393         jbd_debug (3, "JBD: commit phase 1\n");
394
395         /*
396          * Switch to a new revoke table.
397          */
398         journal_switch_revoke_table(journal);
399
400         commit_transaction->t_state = T_FLUSH;
401         journal->j_committing_transaction = commit_transaction;
402         journal->j_running_transaction = NULL;
403         commit_transaction->t_log_start = journal->j_head;
404         wake_up(&journal->j_wait_transaction_locked);
405         spin_unlock(&journal->j_state_lock);
406
407         jbd_debug (3, "JBD: commit phase 2\n");
408
409         /*
410          * First, drop modified flag: all accesses to the buffers
411          * will be tracked for a new trasaction only -bzzz
412          */
413         spin_lock(&journal->j_list_lock);
414         if (commit_transaction->t_buffers) {
415                 new_jh = jh = commit_transaction->t_buffers->b_tnext;
416                 do {
417                         J_ASSERT_JH(new_jh, new_jh->b_modified == 1 ||
418                                         new_jh->b_modified == 0);
419                         new_jh->b_modified = 0;
420                         new_jh = new_jh->b_tnext;
421                 } while (new_jh != jh);
422         }
423         spin_unlock(&journal->j_list_lock);
424
425         /*
426          * Now start flushing things to disk, in the order they appear
427          * on the transaction lists.  Data blocks go first.
428          */
429         err = 0;
430         journal_submit_data_buffers(journal, commit_transaction);
431
432         /*
433          * Wait for all previously submitted IO to complete.
434          */
435         spin_lock(&journal->j_list_lock);
436         while (commit_transaction->t_locked_list) {
437                 struct buffer_head *bh;
438
439                 jh = commit_transaction->t_locked_list->b_tprev;
440                 bh = jh2bh(jh);
441                 get_bh(bh);
442                 if (buffer_locked(bh)) {
443                         spin_unlock(&journal->j_list_lock);
444                         wait_on_buffer(bh);
445                         if (unlikely(!buffer_uptodate(bh)))
446                                 err = -EIO;
447                         spin_lock(&journal->j_list_lock);
448                 }
449                 if (!inverted_lock(journal, bh)) {
450                         put_bh(bh);
451                         spin_lock(&journal->j_list_lock);
452                         continue;
453                 }
454                 if (buffer_jbd(bh) && jh->b_jlist == BJ_Locked) {
455                         __journal_unfile_buffer(jh);
456                         jbd_unlock_bh_state(bh);
457                         journal_remove_journal_head(bh);
458                         put_bh(bh);
459                 } else {
460                         jbd_unlock_bh_state(bh);
461                 }
462                 put_bh(bh);
463                 cond_resched_lock(&journal->j_list_lock);
464         }
465         spin_unlock(&journal->j_list_lock);
466
467         if (err)
468                 journal_abort(journal, err);
469
470         journal_write_revoke_records(journal, commit_transaction);
471
472         jbd_debug(3, "JBD: commit phase 2\n");
473
474         /*
475          * If we found any dirty or locked buffers, then we should have
476          * looped back up to the write_out_data label.  If there weren't
477          * any then journal_clean_data_list should have wiped the list
478          * clean by now, so check that it is in fact empty.
479          */
480         J_ASSERT (commit_transaction->t_sync_datalist == NULL);
481
482         jbd_debug (3, "JBD: commit phase 3\n");
483
484         /*
485          * Way to go: we have now written out all of the data for a
486          * transaction!  Now comes the tricky part: we need to write out
487          * metadata.  Loop over the transaction's entire buffer list:
488          */
489         commit_transaction->t_state = T_COMMIT;
490
491         descriptor = NULL;
492         bufs = 0;
493         while (commit_transaction->t_buffers) {
494
495                 /* Find the next buffer to be journaled... */
496
497                 jh = commit_transaction->t_buffers;
498
499                 /* If we're in abort mode, we just un-journal the buffer and
500                    release it for background writing. */
501
502                 if (is_journal_aborted(journal)) {
503                         JBUFFER_TRACE(jh, "journal is aborting: refile");
504                         journal_refile_buffer(journal, jh);
505                         /* If that was the last one, we need to clean up
506                          * any descriptor buffers which may have been
507                          * already allocated, even if we are now
508                          * aborting. */
509                         if (!commit_transaction->t_buffers)
510                                 goto start_journal_io;
511                         continue;
512                 }
513
514                 /* Make sure we have a descriptor block in which to
515                    record the metadata buffer. */
516
517                 if (!descriptor) {
518                         struct buffer_head *bh;
519
520                         J_ASSERT (bufs == 0);
521
522                         jbd_debug(4, "JBD: get descriptor\n");
523
524                         descriptor = journal_get_descriptor_buffer(journal);
525                         if (!descriptor) {
526                                 journal_abort(journal, -EIO);
527                                 continue;
528                         }
529
530                         bh = jh2bh(descriptor);
531                         jbd_debug(4, "JBD: got buffer %llu (%p)\n",
532                                 (unsigned long long)bh->b_blocknr, bh->b_data);
533                         header = (journal_header_t *)&bh->b_data[0];
534                         header->h_magic     = cpu_to_be32(JFS_MAGIC_NUMBER);
535                         header->h_blocktype = cpu_to_be32(JFS_DESCRIPTOR_BLOCK);
536                         header->h_sequence  = cpu_to_be32(commit_transaction->t_tid);
537
538                         tagp = &bh->b_data[sizeof(journal_header_t)];
539                         space_left = bh->b_size - sizeof(journal_header_t);
540                         first_tag = 1;
541                         set_buffer_jwrite(bh);
542                         set_buffer_dirty(bh);
543                         wbuf[bufs++] = bh;
544
545                         /* Record it so that we can wait for IO
546                            completion later */
547                         BUFFER_TRACE(bh, "ph3: file as descriptor");
548                         journal_file_buffer(descriptor, commit_transaction,
549                                         BJ_LogCtl);
550                 }
551
552                 /* Where is the buffer to be written? */
553
554                 err = journal_next_log_block(journal, &blocknr);
555                 /* If the block mapping failed, just abandon the buffer
556                    and repeat this loop: we'll fall into the
557                    refile-on-abort condition above. */
558                 if (err) {
559                         journal_abort(journal, err);
560                         continue;
561                 }
562
563                 /*
564                  * start_this_handle() uses t_outstanding_credits to determine
565                  * the free space in the log, but this counter is changed
566                  * by journal_next_log_block() also.
567                  */
568                 commit_transaction->t_outstanding_credits--;
569
570                 /* Bump b_count to prevent truncate from stumbling over
571                    the shadowed buffer!  @@@ This can go if we ever get
572                    rid of the BJ_IO/BJ_Shadow pairing of buffers. */
573                 atomic_inc(&jh2bh(jh)->b_count);
574
575                 /* Make a temporary IO buffer with which to write it out
576                    (this will requeue both the metadata buffer and the
577                    temporary IO buffer). new_bh goes on BJ_IO*/
578
579                 set_bit(BH_JWrite, &jh2bh(jh)->b_state);
580                 /*
581                  * akpm: journal_write_metadata_buffer() sets
582                  * new_bh->b_transaction to commit_transaction.
583                  * We need to clean this up before we release new_bh
584                  * (which is of type BJ_IO)
585                  */
586                 JBUFFER_TRACE(jh, "ph3: write metadata");
587                 flags = journal_write_metadata_buffer(commit_transaction,
588                                                       jh, &new_jh, blocknr);
589                 set_bit(BH_JWrite, &jh2bh(new_jh)->b_state);
590                 wbuf[bufs++] = jh2bh(new_jh);
591
592                 /* Record the new block's tag in the current descriptor
593                    buffer */
594
595                 tag_flag = 0;
596                 if (flags & 1)
597                         tag_flag |= JFS_FLAG_ESCAPE;
598                 if (!first_tag)
599                         tag_flag |= JFS_FLAG_SAME_UUID;
600
601                 tag = (journal_block_tag_t *) tagp;
602                 tag->t_blocknr = cpu_to_be32(jh2bh(jh)->b_blocknr);
603                 tag->t_flags = cpu_to_be32(tag_flag);
604                 tagp += sizeof(journal_block_tag_t);
605                 space_left -= sizeof(journal_block_tag_t);
606
607                 if (first_tag) {
608                         memcpy (tagp, journal->j_uuid, 16);
609                         tagp += 16;
610                         space_left -= 16;
611                         first_tag = 0;
612                 }
613
614                 /* If there's no more to do, or if the descriptor is full,
615                    let the IO rip! */
616
617                 if (bufs == journal->j_wbufsize ||
618                     commit_transaction->t_buffers == NULL ||
619                     space_left < sizeof(journal_block_tag_t) + 16) {
620
621                         jbd_debug(4, "JBD: Submit %d IOs\n", bufs);
622
623                         /* Write an end-of-descriptor marker before
624                            submitting the IOs.  "tag" still points to
625                            the last tag we set up. */
626
627                         tag->t_flags |= cpu_to_be32(JFS_FLAG_LAST_TAG);
628
629 start_journal_io:
630                         for (i = 0; i < bufs; i++) {
631                                 struct buffer_head *bh = wbuf[i];
632                                 lock_buffer(bh);
633                                 clear_buffer_dirty(bh);
634                                 set_buffer_uptodate(bh);
635                                 bh->b_end_io = journal_end_buffer_io_sync;
636                                 submit_bh(WRITE, bh);
637                         }
638                         cond_resched();
639
640                         /* Force a new descriptor to be generated next
641                            time round the loop. */
642                         descriptor = NULL;
643                         bufs = 0;
644                 }
645         }
646
647         /* Lo and behold: we have just managed to send a transaction to
648            the log.  Before we can commit it, wait for the IO so far to
649            complete.  Control buffers being written are on the
650            transaction's t_log_list queue, and metadata buffers are on
651            the t_iobuf_list queue.
652
653            Wait for the buffers in reverse order.  That way we are
654            less likely to be woken up until all IOs have completed, and
655            so we incur less scheduling load.
656         */
657
658         jbd_debug(3, "JBD: commit phase 4\n");
659
660         /*
661          * akpm: these are BJ_IO, and j_list_lock is not needed.
662          * See __journal_try_to_free_buffer.
663          */
664 wait_for_iobuf:
665         while (commit_transaction->t_iobuf_list != NULL) {
666                 struct buffer_head *bh;
667
668                 jh = commit_transaction->t_iobuf_list->b_tprev;
669                 bh = jh2bh(jh);
670                 if (buffer_locked(bh)) {
671                         wait_on_buffer(bh);
672                         goto wait_for_iobuf;
673                 }
674                 if (cond_resched())
675                         goto wait_for_iobuf;
676
677                 if (unlikely(!buffer_uptodate(bh)))
678                         err = -EIO;
679
680                 clear_buffer_jwrite(bh);
681
682                 JBUFFER_TRACE(jh, "ph4: unfile after journal write");
683                 journal_unfile_buffer(journal, jh);
684
685                 /*
686                  * ->t_iobuf_list should contain only dummy buffer_heads
687                  * which were created by journal_write_metadata_buffer().
688                  */
689                 BUFFER_TRACE(bh, "dumping temporary bh");
690                 journal_put_journal_head(jh);
691                 __brelse(bh);
692                 J_ASSERT_BH(bh, atomic_read(&bh->b_count) == 0);
693                 free_buffer_head(bh);
694
695                 /* We also have to unlock and free the corresponding
696                    shadowed buffer */
697                 jh = commit_transaction->t_shadow_list->b_tprev;
698                 bh = jh2bh(jh);
699                 clear_bit(BH_JWrite, &bh->b_state);
700                 J_ASSERT_BH(bh, buffer_jbddirty(bh));
701
702                 /* The metadata is now released for reuse, but we need
703                    to remember it against this transaction so that when
704                    we finally commit, we can do any checkpointing
705                    required. */
706                 JBUFFER_TRACE(jh, "file as BJ_Forget");
707                 journal_file_buffer(jh, commit_transaction, BJ_Forget);
708                 /* Wake up any transactions which were waiting for this
709                    IO to complete */
710                 wake_up_bit(&bh->b_state, BH_Unshadow);
711                 JBUFFER_TRACE(jh, "brelse shadowed buffer");
712                 __brelse(bh);
713         }
714
715         J_ASSERT (commit_transaction->t_shadow_list == NULL);
716
717         jbd_debug(3, "JBD: commit phase 5\n");
718
719         /* Here we wait for the revoke record and descriptor record buffers */
720  wait_for_ctlbuf:
721         while (commit_transaction->t_log_list != NULL) {
722                 struct buffer_head *bh;
723
724                 jh = commit_transaction->t_log_list->b_tprev;
725                 bh = jh2bh(jh);
726                 if (buffer_locked(bh)) {
727                         wait_on_buffer(bh);
728                         goto wait_for_ctlbuf;
729                 }
730                 if (cond_resched())
731                         goto wait_for_ctlbuf;
732
733                 if (unlikely(!buffer_uptodate(bh)))
734                         err = -EIO;
735
736                 BUFFER_TRACE(bh, "ph5: control buffer writeout done: unfile");
737                 clear_buffer_jwrite(bh);
738                 journal_unfile_buffer(journal, jh);
739                 journal_put_journal_head(jh);
740                 __brelse(bh);           /* One for getblk */
741                 /* AKPM: bforget here */
742         }
743
744         jbd_debug(3, "JBD: commit phase 6\n");
745
746         if (journal_write_commit_record(journal, commit_transaction))
747                 err = -EIO;
748
749         if (err)
750                 journal_abort(journal, err);
751
752         /* End of a transaction!  Finally, we can do checkpoint
753            processing: any buffers committed as a result of this
754            transaction can be removed from any checkpoint list it was on
755            before. */
756
757         jbd_debug(3, "JBD: commit phase 7\n");
758
759         J_ASSERT(commit_transaction->t_sync_datalist == NULL);
760         J_ASSERT(commit_transaction->t_buffers == NULL);
761         J_ASSERT(commit_transaction->t_checkpoint_list == NULL);
762         J_ASSERT(commit_transaction->t_iobuf_list == NULL);
763         J_ASSERT(commit_transaction->t_shadow_list == NULL);
764         J_ASSERT(commit_transaction->t_log_list == NULL);
765
766 restart_loop:
767         /*
768          * As there are other places (journal_unmap_buffer()) adding buffers
769          * to this list we have to be careful and hold the j_list_lock.
770          */
771         spin_lock(&journal->j_list_lock);
772         while (commit_transaction->t_forget) {
773                 transaction_t *cp_transaction;
774                 struct buffer_head *bh;
775
776                 jh = commit_transaction->t_forget;
777                 spin_unlock(&journal->j_list_lock);
778                 bh = jh2bh(jh);
779                 jbd_lock_bh_state(bh);
780                 J_ASSERT_JH(jh, jh->b_transaction == commit_transaction ||
781                         jh->b_transaction == journal->j_running_transaction);
782
783                 /*
784                  * If there is undo-protected committed data against
785                  * this buffer, then we can remove it now.  If it is a
786                  * buffer needing such protection, the old frozen_data
787                  * field now points to a committed version of the
788                  * buffer, so rotate that field to the new committed
789                  * data.
790                  *
791                  * Otherwise, we can just throw away the frozen data now.
792                  */
793                 if (jh->b_committed_data) {
794                         jbd_free(jh->b_committed_data, bh->b_size);
795                         jh->b_committed_data = NULL;
796                         if (jh->b_frozen_data) {
797                                 jh->b_committed_data = jh->b_frozen_data;
798                                 jh->b_frozen_data = NULL;
799                         }
800                 } else if (jh->b_frozen_data) {
801                         jbd_free(jh->b_frozen_data, bh->b_size);
802                         jh->b_frozen_data = NULL;
803                 }
804
805                 spin_lock(&journal->j_list_lock);
806                 cp_transaction = jh->b_cp_transaction;
807                 if (cp_transaction) {
808                         JBUFFER_TRACE(jh, "remove from old cp transaction");
809                         __journal_remove_checkpoint(jh);
810                 }
811
812                 /* Only re-checkpoint the buffer_head if it is marked
813                  * dirty.  If the buffer was added to the BJ_Forget list
814                  * by journal_forget, it may no longer be dirty and
815                  * there's no point in keeping a checkpoint record for
816                  * it. */
817
818                 /* A buffer which has been freed while still being
819                  * journaled by a previous transaction may end up still
820                  * being dirty here, but we want to avoid writing back
821                  * that buffer in the future now that the last use has
822                  * been committed.  That's not only a performance gain,
823                  * it also stops aliasing problems if the buffer is left
824                  * behind for writeback and gets reallocated for another
825                  * use in a different page. */
826                 if (buffer_freed(bh)) {
827                         clear_buffer_freed(bh);
828                         clear_buffer_jbddirty(bh);
829                 }
830
831                 if (buffer_jbddirty(bh)) {
832                         JBUFFER_TRACE(jh, "add to new checkpointing trans");
833                         __journal_insert_checkpoint(jh, commit_transaction);
834                         JBUFFER_TRACE(jh, "refile for checkpoint writeback");
835                         __journal_refile_buffer(jh);
836                         jbd_unlock_bh_state(bh);
837                 } else {
838                         J_ASSERT_BH(bh, !buffer_dirty(bh));
839                         /* The buffer on BJ_Forget list and not jbddirty means
840                          * it has been freed by this transaction and hence it
841                          * could not have been reallocated until this
842                          * transaction has committed. *BUT* it could be
843                          * reallocated once we have written all the data to
844                          * disk and before we process the buffer on BJ_Forget
845                          * list. */
846                         JBUFFER_TRACE(jh, "refile or unfile freed buffer");
847                         __journal_refile_buffer(jh);
848                         if (!jh->b_transaction) {
849                                 jbd_unlock_bh_state(bh);
850                                  /* needs a brelse */
851                                 journal_remove_journal_head(bh);
852                                 release_buffer_page(bh);
853                         } else
854                                 jbd_unlock_bh_state(bh);
855                 }
856                 cond_resched_lock(&journal->j_list_lock);
857         }
858         spin_unlock(&journal->j_list_lock);
859         /*
860          * This is a bit sleazy.  We use j_list_lock to protect transition
861          * of a transaction into T_FINISHED state and calling
862          * __journal_drop_transaction(). Otherwise we could race with
863          * other checkpointing code processing the transaction...
864          */
865         spin_lock(&journal->j_state_lock);
866         spin_lock(&journal->j_list_lock);
867         /*
868          * Now recheck if some buffers did not get attached to the transaction
869          * while the lock was dropped...
870          */
871         if (commit_transaction->t_forget) {
872                 spin_unlock(&journal->j_list_lock);
873                 spin_unlock(&journal->j_state_lock);
874                 goto restart_loop;
875         }
876
877         /* Done with this transaction! */
878
879         jbd_debug(3, "JBD: commit phase 8\n");
880
881         J_ASSERT(commit_transaction->t_state == T_COMMIT);
882
883         commit_transaction->t_state = T_FINISHED;
884         J_ASSERT(commit_transaction == journal->j_committing_transaction);
885         journal->j_commit_sequence = commit_transaction->t_tid;
886         journal->j_committing_transaction = NULL;
887         spin_unlock(&journal->j_state_lock);
888
889         if (commit_transaction->t_checkpoint_list == NULL &&
890             commit_transaction->t_checkpoint_io_list == NULL) {
891                 __journal_drop_transaction(journal, commit_transaction);
892         } else {
893                 if (journal->j_checkpoint_transactions == NULL) {
894                         journal->j_checkpoint_transactions = commit_transaction;
895                         commit_transaction->t_cpnext = commit_transaction;
896                         commit_transaction->t_cpprev = commit_transaction;
897                 } else {
898                         commit_transaction->t_cpnext =
899                                 journal->j_checkpoint_transactions;
900                         commit_transaction->t_cpprev =
901                                 commit_transaction->t_cpnext->t_cpprev;
902                         commit_transaction->t_cpnext->t_cpprev =
903                                 commit_transaction;
904                         commit_transaction->t_cpprev->t_cpnext =
905                                 commit_transaction;
906                 }
907         }
908         spin_unlock(&journal->j_list_lock);
909
910         jbd_debug(1, "JBD: commit %d complete, head %d\n",
911                   journal->j_commit_sequence, journal->j_tail_sequence);
912
913         wake_up(&journal->j_wait_done_commit);
914 }