There is a race window where quota was redirted once we drop dq_list_lock inside dqput(), but before we grab dquot->dq_lock inside dquot_release() TASK1 TASK2 (chowner) ->dqput() we_slept: spin_lock(&dq_list_lock) if (dquot_dirty(dquot)) { spin_unlock(&dq_list_lock); dquot->dq_sb->dq_op->write_dquot(dquot); goto we_slept if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { spin_unlock(&dq_list_lock); dquot->dq_sb->dq_op->release_dquot(dquot); dqget() mark_dquot_dirty() dqput() goto we_slept; } So dquot dirty quota will be released by TASK1, but on next we_sleept loop we detect this and call ->write_dquot() for it. XFSTEST: https://github.com/dmonakhov/xfstests/commit/440a80d4cbb39e9234df4d7240aee1d551c36107
Unified · Split
| @@ -728,7 +728,7 @@ static int ocfs2_release_dquot(struct dquot *dquot) · 727 unmodified lines | |||
| 728 | 728 | ||
| 729 | mutex_lock(&dquot->dq_lock); | 729 | mutex_lock(&dquot->dq_lock); |
| 730 | /* Check whether we are not racing with some other dqget() */ | 730 | /* Check whether we are not racing with some other dqget() */ |
| 731 | if (atomic_read(&dquot->dq_count) > 1) | 731 | if (dquot_is_busy(dquot)) |
| 732 | goto out; | 732 | goto out; |
| 733 | /* Running from downconvert thread? Postpone quota processing to wq */ | 733 | /* Running from downconvert thread? Postpone quota processing to wq */ |
| 734 | if (current == osb->dc_task) { | 734 | if (current == osb->dc_task) { |
| @@ -497,7 +497,7 @@ int dquot_release(struct dquot *dquot) · 496 unmodified lines | |||
| 497 | 497 | ||
| 498 | mutex_lock(&dquot->dq_lock); | 498 | mutex_lock(&dquot->dq_lock); |
| 499 | /* Check whether we are not racing with some other dqget() */ | 499 | /* Check whether we are not racing with some other dqget() */ |
| 500 | if (atomic_read(&dquot->dq_count) > 1) | 500 | if (dquot_is_busy(dquot)) |
| 501 | goto out_dqlock; | 501 | goto out_dqlock; |
| 502 | if (dqopt->ops[dquot->dq_id.type]->release_dqblk) { | 502 | if (dqopt->ops[dquot->dq_id.type]->release_dqblk) { |
| 503 | ret = dqopt->ops[dquot->dq_id.type]->release_dqblk(dquot); | 503 | ret = dqopt->ops[dquot->dq_id.type]->release_dqblk(dquot); |
| @@ -54,6 +54,16 @@ static inline struct dquot *dqgrab(struct dquot *dquot) · 53 unmodified lines | |||
| 54 | atomic_inc(&dquot->dq_count); | 54 | atomic_inc(&dquot->dq_count); |
| 55 | return dquot; | 55 | return dquot; |
| 56 | } | 56 | } |
| 57 | |||
| 58 | static inline bool dquot_is_busy(struct dquot *dquot) | ||
| 59 | { | ||
| 60 | if (test_bit(DQ_MOD_B, &dquot->dq_flags)) | ||
| 61 | return true; | ||
| 62 | if (atomic_read(&dquot->dq_count) > 1) | ||
| 63 | return true; | ||
| 64 | return false; | ||
| 65 | } | ||
| 66 | |||
| 57 | void dqput(struct dquot *dquot); | 67 | void dqput(struct dquot *dquot); |
| 58 | int dquot_scan_active(struct super_block *sb, | 68 | int dquot_scan_active(struct super_block *sb, |
| 59 | int (*fn)(struct dquot *dquot, unsigned long priv), | 69 | int (*fn)(struct dquot *dquot, unsigned long priv), |