deadlocks caused by ext3/reiser dirty_inode calls during do_mmap_pgoff

Index: linux.mm/fs/reiserfs/file.c
===================================================================
@@ -548,8 +548,35 @@ void reiserfs_unprepare_pages(struct pag
     }
 }
 
+static int prefault_pages_for_write(loff_t pos, const char *buf, 
+                                     size_t count)
+{
+    unsigned long off;
+    unsigned long bytes;
+    int status;
+
+    /* looks like fault_in_pages_readable only does 1 page, so lets make
+     * a loop
+     */
+    do {
+	off = (pos & (PAGE_CACHE_SIZE - 1));
+	bytes = PAGE_CACHE_SIZE - off;
+	if (bytes > count)
+	    bytes = count;
+	status = fault_in_pages_readable(buf, bytes);
+	if (status)
+	    return -EFAULT;
+        count -= bytes;
+	buf += bytes;
+	pos += bytes;
+    } while(count > 0);
+    return 0;
+}
+
 /* This function will copy data from userspace to specified pages within
-   supplied byte range */
+ * supplied byte range, this returns zero if all went well, or -EFAULT if
+ * it was unable to copy some pages
+ */
 int reiserfs_copy_from_user_to_file_region(
 				loff_t pos, /* In-file position */
 				int num_pages, /* Number of pages affected */

@@ -565,24 +592,36 @@ int reiserfs_copy_from_user_to_file_regi
     long page_fault=0; // status of copy_from_user.
     int i; // loop counter.
     int offset; // offset in page
+    int zero_all = 0;
 
     for ( i = 0, offset = (pos & (PAGE_CACHE_SIZE-1)); i < num_pages ; i++,offset=0) {
 	int count = min_t(int,PAGE_CACHE_SIZE-offset,write_bytes); // How much of bytes to write to this page
 	struct page *page=prepared_pages[i]; // Current page we process.
-
-	fault_in_pages_readable( buf, count);
+	char *kaddr;
 
 	/* Copy data from userspace to the current page */
-	kmap(page);
-	page_fault = __copy_from_user(page_address(page)+offset, buf, count); // Copy the data.
+	kaddr = kmap_atomic(page, KM_USER0);
+	if (zero_all)
+	    memset(kaddr+offset, 0, count);
+	else {
+	    /* we need to make sure we don't
+	     * take a page fault, otherwise we end up with a lock
+	     * inversion deadlock against the log.  inc_preempt_count
+	     * should do the trick.
+	     */
+	    inc_preempt_count();
+	    page_fault = __copy_from_user(kaddr+offset, buf, count);
+	    dec_preempt_count();
+	}
+	kunmap_atomic(kaddr, KM_USER0);
+
 	/* Flush processor's dcache for this page */
 	flush_dcache_page(page);
-	kunmap(page);
 	buf+=count;
 	write_bytes-=count;
 
 	if (page_fault)
-	    break; // Was there a fault? abort.
+	    zero_all = 1;
     }
 
     return page_fault?-EFAULT:0;

@@ -1182,6 +1221,7 @@ ssize_t reiserfs_file_write( struct file
 	int blocks_to_allocate; /* how much blocks we need to allocate for
 				   this iteration */
         
+	int page_fault;
         /*  (pos & (PAGE_CACHE_SIZE-1)) is an idiom for offset into a page of pos*/
 	num_pages = !!((pos+count) & (PAGE_CACHE_SIZE - 1)) + /* round up partial
 							  pages */

@@ -1240,6 +1280,15 @@ ssize_t reiserfs_file_write( struct file
 	/* First we correct our estimate of how many blocks we need */
 	reiserfs_release_claimed_blocks(inode->i_sb, (num_pages << (PAGE_CACHE_SHIFT - inode->i_sb->s_blocksize_bits)) - blocks_to_allocate );
 
+	/* prefault the pages now, this the last possible moment before
+	 * we start a transaction
+	 */
+	res = prefault_pages_for_write(pos, buf, write_bytes);
+	if (res) {
+	    reiserfs_unprepare_pages(prepared_pages, num_pages);
+	    break;
+	}
+
 	if ( blocks_to_allocate > 0) {/*We only allocate blocks if we need to*/
 	    /* Fill in all the possible holes and append the file if needed */
 	    res = reiserfs_allocate_blocks_for_region(&th, inode, pos, num_pages, write_bytes, prepared_pages, blocks_to_allocate);

@@ -1258,11 +1307,7 @@ ssize_t reiserfs_file_write( struct file
    crash */
 
 	/* Copy data from user-supplied buffer to file's pages */
-	res = reiserfs_copy_from_user_to_file_region(pos, num_pages, write_bytes, prepared_pages, buf);
-	if ( res ) {
-	    reiserfs_unprepare_pages(prepared_pages, num_pages);
-	    break;
-	}
+	page_fault = reiserfs_copy_from_user_to_file_region(pos, num_pages, write_bytes, prepared_pages, buf);
 
 	/* Send the pages to disk and unlock them. */
 	res = reiserfs_submit_file_region_for_write(&th, inode, pos, num_pages,

@@ -1270,10 +1315,16 @@ ssize_t reiserfs_file_write( struct file
 	if ( res )
 	    break;
 
-	already_written += write_bytes;
-	buf += write_bytes;
-	*ppos = pos += write_bytes;
-	count -= write_bytes;
+	/* if we get a page fault, leave all the counters alone.
+	 * we'll retry this exact same section of the write again
+	 * after closing and restarting the transaction
+	 */
+	if (!page_fault) {
+	    already_written += write_bytes;
+	    buf += write_bytes;
+	    *ppos = pos += write_bytes;
+	    count -= write_bytes;
+	}
 	balance_dirty_pages_ratelimited(inode->i_mapping);
     }
 

Index: linux.mm/include/linux/pagemap.h
===================================================================
@@ -219,7 +219,10 @@ static inline int fault_in_pages_writeab
 	return ret;
 }
 
-static inline void fault_in_pages_readable(const char __user *uaddr, int size)
+/*
+ * returns zero on success, -EFAULT on failure
+ */
+static inline int fault_in_pages_readable(const char __user *uaddr, int size)
 {
 	volatile char c;
 	int ret;

@@ -230,8 +233,9 @@ static inline void fault_in_pages_readab
 
 		if (((unsigned long)uaddr & PAGE_MASK) !=
 				((unsigned long)end & PAGE_MASK))
-		 	__get_user(c, end);
+		 	ret = __get_user(c, end);
 	}
+	return ret;
 }
 
 #endif /* _LINUX_PAGEMAP_H */

Index: linux.mm/mm/filemap.c
===================================================================
@@ -1633,15 +1633,11 @@ filemap_copy_from_user(struct page *page
 	int left;
 
 	kaddr = kmap_atomic(page, KM_USER0);
+	inc_preempt_count();
 	left = __copy_from_user(kaddr + offset, buf, bytes);
+	dec_preempt_count();
 	kunmap_atomic(kaddr, KM_USER0);
 
-	if (left != 0) {
-		/* Do it the slow way */
-		kaddr = kmap(page);
-		left = __copy_from_user(kaddr + offset, buf, bytes);
-		kunmap(page);
-	}
 	return bytes - left;
 }
 

@@ -1933,7 +1929,9 @@ generic_file_aio_write_nolock(struct kio
 		 * same page as we're writing to, without it being marked
 		 * up-to-date.
 		 */
-		fault_in_pages_readable(buf, bytes);
+		status = fault_in_pages_readable(buf, bytes);
+		if (status < 0)
+			break;
 
 		page = __grab_cache_page(mapping,index,&cached_page,&lru_pvec);
 		if (!page) {

@@ -1976,9 +1974,6 @@ generic_file_aio_write_nolock(struct kio
 							&iov_base, status);
 			}
 		}
-		if (unlikely(copied != bytes))
-			if (status >= 0)
-				status = -EFAULT;
 		unlock_page(page);
 		mark_page_accessed(page);
 		page_cache_release(page);