quota: Check that quota is not dirty before release

BugLink: https://bugs.launchpad.net/bugs/1857158
commit df4bb5d128e2c44848aeb36b7ceceba3ac85080d upstream.

There is a race window where quota was redirted once we drop dq_list_lock inside dqput(),
but before we grab dquot->dq_lock inside dquot_release()

TASK1                                                       TASK2 (chowner)
->dqput()
  we_slept:
    spin_lock(&dq_list_lock)
    if (dquot_dirty(dquot)) {
          spin_unlock(&dq_list_lock);
          dquot->dq_sb->dq_op->write_dquot(dquot);
          goto we_slept
    if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
          spin_unlock(&dq_list_lock);
          dquot->dq_sb->dq_op->release_dquot(dquot);
                                                            dqget()
							    mark_dquot_dirty()
							    dqput()
          goto we_slept;
        }
So dquot dirty quota will be released by TASK1, but on next we_sleept loop
we detect this and call ->write_dquot() for it.
XFSTEST: https://github.com/dmonakhov/xfstests/commit/440a80d4cbb39e9234df4d7240aee1d551c36107

Link: https://lore.kernel.org/r/20191031103920.3919-2-dmonakhov@openvz.org
CC: stable@vger.kernel.org
Signed-off-by: Dmitry Monakhov <dmtrmonakhov@yandex-team.ru>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
index b39d14cbfa34d949eea04a5253772c22aa5af625..d212d09c00b15f908da86fbed959bfbb85cb2fe4 100644 (file)
--- a/fs/ocfs2/quota_global.c
+++ b/fs/ocfs2/quota_global.c
@@ -727,7 +727,7 @@ static int ocfs2_release_dquot(struct dquot *dquot)
 
        mutex_lock(&dquot->dq_lock);
        /* Check whether we are not racing with some other dqget() */
-       if (atomic_read(&dquot->dq_count) > 1)
+       if (dquot_is_busy(dquot))
                goto out;
        /* Running from downconvert thread? Postpone quota processing to wq */
        if (current == osb->dc_task) {

diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 69bbb6cd74da18b8503b05a306e90467af361ccc..a237f2b9d621af41681bed5ff061e8ed7ce923a5 100644 (file)
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -491,7 +491,7 @@ int dquot_release(struct dquot *dquot)
 
        mutex_lock(&dquot->dq_lock);
        /* Check whether we are not racing with some other dqget() */
-       if (atomic_read(&dquot->dq_count) > 1)
+       if (dquot_is_busy(dquot))
                goto out_dqlock;
        if (dqopt->ops[dquot->dq_id.type]->release_dqblk) {
                ret = dqopt->ops[dquot->dq_id.type]->release_dqblk(dquot);

diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
index a109e6107c06305d24337dd5b41871a86e7cc5e7..50ab5d6ccc4edaf5e3f152046752f2f9f317010e 100644 (file)
--- a/include/linux/quotaops.h
+++ b/include/linux/quotaops.h
@@ -51,6 +51,16 @@ static inline struct dquot *dqgrab(struct dquot *dquot)
        atomic_inc(&dquot->dq_count);
        return dquot;
 }
+
+static inline bool dquot_is_busy(struct dquot *dquot)
+{
+       if (test_bit(DQ_MOD_B, &dquot->dq_flags))
+               return true;
+       if (atomic_read(&dquot->dq_count) > 1)
+               return true;
+       return false;
+}
+
 void dqput(struct dquot *dquot);
 int dquot_scan_active(struct super_block *sb,
                      int (*fn)(struct dquot *dquot, unsigned long priv),