Patchwork [3.8.y.z,extended,stable] Patch "jbd2: fix theoretical race in jbd2__journal_restart" has been added to staging queue

mail settings
Submitter Luis Henriques
Date July 9, 2013, 4:29 p.m.
Message ID <>
Download mbox | patch
Permalink /patch/257816/
State New
Headers show


Luis Henriques - July 9, 2013, 4:29 p.m.
This is a note to let you know that I have just added a patch titled

    jbd2: fix theoretical race in jbd2__journal_restart

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.8.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see



From 8a766a466098171f670beba8bc29366c9ff0cd54 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <>
Date: Mon, 1 Jul 2013 08:12:40 -0400
Subject: [PATCH] jbd2: fix theoretical race in jbd2__journal_restart

commit 39c04153fda8c32e85b51c96eb5511a326ad7609 upstream.

Once we decrement transaction->t_updates, if this is the last handle
holding the transaction from closing, and once we release the
t_handle_lock spinlock, it's possible for the transaction to commit
and be released.  In practice with normal kernels, this probably won't
happen, since the commit happens in a separate kernel thread and it's
unlikely this could all happen within the space of a few CPU cycles.

On the other hand, with a real-time kernel, this could potentially
happen, so save the tid found in transaction->t_tid before we release
t_handle_lock.  It would require an insane configuration, such as one
where the jbd2 thread was set to a very high real-time priority,
perhaps because a high priority real-time thread is trying to read or
write to a file system.  But some people who use real-time kernels
have been known to do insane things, including controlling
laser-wielding industrial robots.  :-)

Signed-off-by: "Theodore Ts'o" <>
[ luis: backported to 3.8: adjusted context ]
Signed-off-by: Luis Henriques <>
 fs/jbd2/transaction.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)



diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 73b9253..2f78ba3 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -500,10 +500,10 @@  int jbd2__journal_restart(handle_t *handle, int nblocks, gfp_t gfp_mask)
 	if (atomic_dec_and_test(&transaction->t_updates))
+	tid = transaction->t_tid;

 	jbd_debug(2, "restarting handle %p\n", handle);
-	tid = transaction->t_tid;
 	need_to_start = !tid_geq(journal->j_commit_request, tid);
 	if (need_to_start)