quota: Check that quota is not dirty before release

commit df4bb5d128e2c44848aeb36b7ceceba3ac85080d upstream.

There is a race window where quota was redirted once we drop dq_list_lock inside dqput(),
but before we grab dquot->dq_lock inside dquot_release()

TASK1                                                       TASK2 (chowner)
->dqput()
  we_slept:
    spin_lock(&dq_list_lock)
    if (dquot_dirty(dquot)) {
          spin_unlock(&dq_list_lock);
          dquot->dq_sb->dq_op->write_dquot(dquot);
          goto we_slept
    if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
          spin_unlock(&dq_list_lock);
          dquot->dq_sb->dq_op->release_dquot(dquot);
                                                            dqget()
							    mark_dquot_dirty()
							    dqput()
          goto we_slept;
        }
So dquot dirty quota will be released by TASK1, but on next we_sleept loop
we detect this and call ->write_dquot() for it.
XFSTEST: https://github.com/dmonakhov/xfstests/commit/440a80d4cbb39e9234df4d7240aee1d551c36107

Link: https://lore.kernel.org/r/20191031103920.3919-2-dmonakhov@openvz.org
CC: stable@vger.kernel.org
Signed-off-by: Dmitry Monakhov <dmtrmonakhov@yandex-team.ru>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
index 87e577a49b0d567550e09912c179a719a7ee692c..542fa21aeaa9092ef90d214a60f5886b9edac535 100644 (file)
--- a/fs/ocfs2/quota_global.c
+++ b/fs/ocfs2/quota_global.c
@@ -714,7 +714,7 @@ static int ocfs2_release_dquot(struct dquot *dquot)
 
        mutex_lock(&dquot->dq_lock);
        /* Check whether we are not racing with some other dqget() */
-       if (atomic_read(&dquot->dq_count) > 1)
+       if (dquot_is_busy(dquot))
                goto out;
        /* Running from downconvert thread? Postpone quota processing to wq */
        if (current == osb->dc_task) {

diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index f9246ac4eef81493ddbd87237158f6aa423b339f..1c575861bac42f9d56ef7673a090c3cf906d2820 100644 (file)
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -479,7 +479,7 @@ int dquot_release(struct dquot *dquot)
 
        mutex_lock(&dquot->dq_lock);
        /* Check whether we are not racing with some other dqget() */
-       if (atomic_read(&dquot->dq_count) > 1)
+       if (dquot_is_busy(dquot))
                goto out_dqlock;
        mutex_lock(&dqopt->dqio_mutex);
        if (dqopt->ops[dquot->dq_id.type]->release_dqblk) {

diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
index 87733344768c4a53bed321f6d1449d8bfc779527..0a60fe354bc54ff02d6b3f503c991ce5125b15d1 100644 (file)
--- a/include/linux/quotaops.h
+++ b/include/linux/quotaops.h
@@ -54,6 +54,16 @@ static inline struct dquot *dqgrab(struct dquot *dquot)
        atomic_inc(&dquot->dq_count);
        return dquot;
 }
+
+static inline bool dquot_is_busy(struct dquot *dquot)
+{
+       if (test_bit(DQ_MOD_B, &dquot->dq_flags))
+               return true;
+       if (atomic_read(&dquot->dq_count) > 1)
+               return true;
+       return false;
+}
+
 void dqput(struct dquot *dquot);
 int dquot_scan_active(struct super_block *sb,
                      int (*fn)(struct dquot *dquot, unsigned long priv),