Fixed (?) races in mark_buffer_dirty(). We abuse the buffer cache

by hacking on locked buffers without getblk()ing them, and we didn't
even use splbio() to prevent biodone() changing the buffer underneath
use when a write completes.  I think there was no problem in practice
on i386's because the operations on b_flags and numdirtybufs happen to
be atomic.  We still depend on biodone()'s operations on b_flags not
interfering with ours.  I think there is only interference for B_ERROR,
and this is harmless because errors for async writes are ignored anyway.

Don't use mark_buffer_dirty() except for superblock-related metadata.
It was used in just one case where ordinary BSD buffering is more
natural.

1 files changed, 6 insertions, 3 deletions

diff --git a/sys/gnu/fs/ext2fs/ext2_linux_ialloc.c b/sys/gnu/fs/ext2fs/ext2_linux_ialloc.c
index d7f5bec..ee4c418 100644
--- a/sys/gnu/fs/ext2fs/ext2_linux_ialloc.c
+++ b/sys/gnu/fs/ext2fs/ext2_linux_ialloc.c
@@ -53,11 +53,15 @@
  */
 void mark_buffer_dirty(struct buf *bh)
 {
+	int s;
+
+	s = splbio();
 	if (!(bh->b_flags & B_DELWRI)) {
 		numdirtybuffers++;
 		bh->b_flags |= B_DELWRI;
+		bh->b_flags &= ~(B_READ | B_ERROR);
 	}
-	bh->b_flags &= ~(B_READ | B_ERROR);
+	splx(s);
 } 
 
 struct ext2_group_desc * get_group_desc (struct mount * mp,
@@ -274,8 +278,7 @@ static void inc_inode_version (struct inode * inode,
 			EXT2_INODES_PER_BLOCK(inode->i_sb));
 	raw_inode->i_version++;
 	inode->u.ext2_i.i_version = raw_inode->i_version;
-	mark_buffer_dirty(bh);
-	brelse (bh);
+	bdwrite (bh);
 }
 
 #endif /* linux */