There is a race window where quota was redirted once we drop dq_list_lock inside dqput(), but before we grab dquot->dq_lock inside dquot_release() TASK1 TASK2 (chowner) ->dqput() we_slept: spin_lock(&dq_list_lock) if (dquot_dirty(dquot)) { spin_unlock(&dq_list_lock); dquot->dq_sb->dq_op->write_dquot(dquot); goto we_slept if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { spin_unlock(&dq_list_lock); dquot->dq_sb->dq_op->release_dquot(dquot); dqget() mark_dquot_dirty() dqput() goto we_slept; } So dquot dirty quota will be released by TASK1, but on next we_sleept loop we detect this and call ->write_dquot() for it. XFSTEST: https://github.com/dmonakhov/xfstests/commit/440a80d4cbb39e9234df4d7240aee1d551c36107
Showing the changes to include/linux (1 of 3 files). Show all
Unified · Split
| @@ -54,6 +54,16 @@ static inline struct dquot *dqgrab(struct dquot *dquot) · 53 unmodified lines | |||
| 54 | atomic_inc(&dquot->dq_count); | 54 | atomic_inc(&dquot->dq_count); |
| 55 | return dquot; | 55 | return dquot; |
| 56 | } | 56 | } |
| 57 | |||
| 58 | static inline bool dquot_is_busy(struct dquot *dquot) | ||
| 59 | { | ||
| 60 | if (test_bit(DQ_MOD_B, &dquot->dq_flags)) | ||
| 61 | return true; | ||
| 62 | if (atomic_read(&dquot->dq_count) > 1) | ||
| 63 | return true; | ||
| 64 | return false; | ||
| 65 | } | ||
| 66 | |||
| 57 | void dqput(struct dquot *dquot); | 67 | void dqput(struct dquot *dquot); |
| 58 | int dquot_scan_active(struct super_block *sb, | 68 | int dquot_scan_active(struct super_block *sb, |
| 59 | int (*fn)(struct dquot *dquot, unsigned long priv), | 69 | int (*fn)(struct dquot *dquot, unsigned long priv), |