mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-03 23:58:05 +00:00
quota: Check that quota is not dirty before release
commitdf4bb5d128
upstream. There is a race window where quota was redirted once we drop dq_list_lock inside dqput(), but before we grab dquot->dq_lock inside dquot_release() TASK1 TASK2 (chowner) ->dqput() we_slept: spin_lock(&dq_list_lock) if (dquot_dirty(dquot)) { spin_unlock(&dq_list_lock); dquot->dq_sb->dq_op->write_dquot(dquot); goto we_slept if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { spin_unlock(&dq_list_lock); dquot->dq_sb->dq_op->release_dquot(dquot); dqget() mark_dquot_dirty() dqput() goto we_slept; } So dquot dirty quota will be released by TASK1, but on next we_sleept loop we detect this and call ->write_dquot() for it. XFSTEST:440a80d4cb
Link: https://lore.kernel.org/r/20191031103920.3919-2-dmonakhov@openvz.org CC: stable@vger.kernel.org Signed-off-by: Dmitry Monakhov <dmtrmonakhov@yandex-team.ru> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
772098e8b6
commit
f780a35182
3 changed files with 12 additions and 2 deletions
|
@ -727,7 +727,7 @@ static int ocfs2_release_dquot(struct dquot *dquot)
|
||||||
|
|
||||||
mutex_lock(&dquot->dq_lock);
|
mutex_lock(&dquot->dq_lock);
|
||||||
/* Check whether we are not racing with some other dqget() */
|
/* Check whether we are not racing with some other dqget() */
|
||||||
if (atomic_read(&dquot->dq_count) > 1)
|
if (dquot_is_busy(dquot))
|
||||||
goto out;
|
goto out;
|
||||||
/* Running from downconvert thread? Postpone quota processing to wq */
|
/* Running from downconvert thread? Postpone quota processing to wq */
|
||||||
if (current == osb->dc_task) {
|
if (current == osb->dc_task) {
|
||||||
|
|
|
@ -491,7 +491,7 @@ int dquot_release(struct dquot *dquot)
|
||||||
|
|
||||||
mutex_lock(&dquot->dq_lock);
|
mutex_lock(&dquot->dq_lock);
|
||||||
/* Check whether we are not racing with some other dqget() */
|
/* Check whether we are not racing with some other dqget() */
|
||||||
if (atomic_read(&dquot->dq_count) > 1)
|
if (dquot_is_busy(dquot))
|
||||||
goto out_dqlock;
|
goto out_dqlock;
|
||||||
if (dqopt->ops[dquot->dq_id.type]->release_dqblk) {
|
if (dqopt->ops[dquot->dq_id.type]->release_dqblk) {
|
||||||
ret = dqopt->ops[dquot->dq_id.type]->release_dqblk(dquot);
|
ret = dqopt->ops[dquot->dq_id.type]->release_dqblk(dquot);
|
||||||
|
|
|
@ -51,6 +51,16 @@ static inline struct dquot *dqgrab(struct dquot *dquot)
|
||||||
atomic_inc(&dquot->dq_count);
|
atomic_inc(&dquot->dq_count);
|
||||||
return dquot;
|
return dquot;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static inline bool dquot_is_busy(struct dquot *dquot)
|
||||||
|
{
|
||||||
|
if (test_bit(DQ_MOD_B, &dquot->dq_flags))
|
||||||
|
return true;
|
||||||
|
if (atomic_read(&dquot->dq_count) > 1)
|
||||||
|
return true;
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
void dqput(struct dquot *dquot);
|
void dqput(struct dquot *dquot);
|
||||||
int dquot_scan_active(struct super_block *sb,
|
int dquot_scan_active(struct super_block *sb,
|
||||||
int (*fn)(struct dquot *dquot, unsigned long priv),
|
int (*fn)(struct dquot *dquot, unsigned long priv),
|
||||||
|
|
Loading…
Reference in a new issue