There is a race window where quota was redirted once we drop dq_list_lock inside dqput(), but before we grab dquot->dq_lock inside dquot_release() TASK1 TASK2 (chowner) ->dqput() we_slept: spin_lock(&dq_list_lock) if (dquot_dirty(dquot)) { spin_unlock(&dq_list_lock); dquot->dq_sb->dq_op->write_dquot(dquot); goto we_slept if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { spin_unlock(&dq_list_lock); dquot->dq_sb->dq_op->release_dquot(dquot); dqget() mark_dquot_dirty() dqput() goto we_slept; } So dquot dirty quota will be released by TASK1, but on next we_sleept loop we detect this and call ->write_dquot() for it. XFSTEST: https://github.com/dmonakhov/xfstests/commit/440a80d4cbb39e9234df4d7240aee1d551c36107
Showing the changes to include/linux (1 of 3 files). Show all
Unified · Split
| @@ -54,6 +54,16 @@ static inline struct dquot *dqgrab(struct dquot *dquot) · 53 unmodified lines | ||
| 54 | 54 | atomic_inc(&dquot->dq_count); |
| 55 | 55 | return dquot; |
| 56 | 56 | } |
| 57 | + | |
| 58 | +static inline bool dquot_is_busy(struct dquot *dquot) | |
| 59 | +{ | |
| 60 | + if (test_bit(DQ_MOD_B, &dquot->dq_flags)) | |
| 61 | + return true; | |
| 62 | + if (atomic_read(&dquot->dq_count) > 1) | |
| 63 | + return true; | |
| 64 | + return false; | |
| 65 | +} | |
| 66 | + | |
| 57 | 67 | void dqput(struct dquot *dquot); |
| 58 | 68 | int dquot_scan_active(struct super_block *sb, |
| 59 | 69 | int (*fn)(struct dquot *dquot, unsigned long priv), |