[PATCH] Fix minor quota race

[PATCH] Fix minor quota race

[Jan Kara]

[-- Attachment #1: Type: text/plain, Size: 293 bytes --]

  Hello Andrew!

  I'm sending one more quota fix - it fixes a possible race between
quotaoff and prune_icache. The race could lead to some forgotten
pointers to quotas in inodes leading later to BUG when invalidating
quota structures. The patch is against 2.6.7. Please apply.

							Honza


[-- Attachment #2: quota-2.6.7-2-quotaoff.diff --]
[-- Type: text/plain, Size: 2185 bytes --]

diff -rpuX /home/jack/.kerndiffexclude linux-2.6.7-1-flagslock/fs/dquot.c linux-2.6.7-2-quotaoff/fs/dquot.c
--- linux-2.6.7-1-flagslock/fs/dquot.c	2004-07-01 20:49:27.000000000 +0200
+++ linux-2.6.7-2-quotaoff/fs/dquot.c	2004-07-01 20:54:04.000000000 +0200
@@ -114,9 +114,10 @@
  * operations on dquots don't hold dq_lock as they copy data under dq_data_lock
  * spinlock to internal buffers before writing.
  *
- * Lock ordering (including related VFS locks) is following:
- *  i_sem > dqonoff_sem > journal_lock > dqptr_sem > dquot->dq_lock > dqio_sem
- *  i_sem on quota files is special (it's below dqio_sem)
+ * Lock ordering (including some related VFS locks) is the following:
+ *   i_sem > dqonoff_sem > iprune_sem > journal_lock > dqptr_sem >
+ *   > dquot->dq_lock > dqio_sem
+ * i_sem on quota files is special (it's below dqio_sem)
  */
 
 spinlock_t dq_list_lock = SPIN_LOCK_UNLOCKED;
@@ -726,14 +727,20 @@ static void put_dquot_list(struct list_h
 /* Function in inode.c - remove pointers to dquots in icache */
 extern void remove_dquot_ref(struct super_block *, int, struct list_head *);
 
+extern struct semaphore iprune_sem;
+
 /* Gather all references from inodes and drop them */
 static void drop_dquot_ref(struct super_block *sb, int type)
 {
 	LIST_HEAD(tofree_head);
 
+	/* We need to be guarded against prune_icache to reach all the
+	 * inodes - otherwise some can be on the local list of prune_icache */
+	down(&iprune_sem);
 	down_write(&sb_dqopt(sb)->dqptr_sem);
 	remove_dquot_ref(sb, type, &tofree_head);
 	up_write(&sb_dqopt(sb)->dqptr_sem);
+	up(&iprune_sem);
 	put_dquot_list(&tofree_head);
 }
 
diff -rpuX /home/jack/.kerndiffexclude linux-2.6.7-1-flagslock/fs/inode.c linux-2.6.7-2-quotaoff/fs/inode.c
--- linux-2.6.7-1-flagslock/fs/inode.c	2004-06-30 23:17:12.000000000 +0200
+++ linux-2.6.7-2-quotaoff/fs/inode.c	2004-07-01 00:27:08.000000000 +0200
@@ -89,7 +89,7 @@ spinlock_t inode_lock = SPIN_LOCK_UNLOCK
  * from its final dispose_list, the struct super_block they refer to
  * (for inode->i_sb->s_op) may already have been freed and reused.
  */
-static DECLARE_MUTEX(iprune_sem);
+DECLARE_MUTEX(iprune_sem);
 
 /*
  * Statistics gathering..

Re: [PATCH] Fix minor quota race

[Andrew Morton]

Jan Kara <jack@suse.cz> wrote:
>
> I'm sending one more quota fix - it fixes a possible race between
> quotaoff and prune_icache. The race could lead to some forgotten
> pointers to quotas in inodes leading later to BUG when invalidating
> quota structures. The patch is against 2.6.7.

It tossed one reject against the lock ranking comment in dquot.c.  I fixed
that up.

I'll apply the below patch on top of it - please always put extern decls in
header files so that the implementor and all users of the data/function
always see the same declaration.



diff -puN fs/dquot.c~fix-minor-quota-race-tweaks fs/dquot.c
--- 25/fs/dquot.c~fix-minor-quota-race-tweaks	Thu Jul  1 15:05:45 2004
+++ 25-akpm/fs/dquot.c	Thu Jul  1 15:06:12 2004
@@ -730,11 +730,6 @@ static void put_dquot_list(struct list_h
 	}
 }
 
-/* Function in inode.c - remove pointers to dquots in icache */
-extern void remove_dquot_ref(struct super_block *, int, struct list_head *);
-
-extern struct semaphore iprune_sem;
-
 /* Gather all references from inodes and drop them */
 static void drop_dquot_ref(struct super_block *sb, int type)
 {
diff -puN include/linux/fs.h~fix-minor-quota-race-tweaks include/linux/fs.h
--- 25/include/linux/fs.h~fix-minor-quota-race-tweaks	Thu Jul  1 15:05:45 2004
+++ 25-akpm/include/linux/fs.h	Thu Jul  1 15:07:08 2004
@@ -1386,6 +1386,8 @@ extern void clear_inode(struct inode *);
 extern void destroy_inode(struct inode *);
 extern struct inode *new_inode(struct super_block *);
 extern int remove_suid(struct dentry *);
+extern void remove_dquot_ref(struct super_block *, int, struct list_head *);
+extern struct semaphore iprune_sem;
 
 extern void __insert_inode_hash(struct inode *, unsigned long hashval);
 extern void remove_inode_hash(struct inode *);
_

Re: [PATCH] Fix minor quota race

[Jan Kara]

> Jan Kara <jack@suse.cz> wrote:
> >
> > I'm sending one more quota fix - it fixes a possible race between
> > quotaoff and prune_icache. The race could lead to some forgotten
> > pointers to quotas in inodes leading later to BUG when invalidating
> > quota structures. The patch is against 2.6.7.
> 
> It tossed one reject against the lock ranking comment in dquot.c.  I fixed
> that up.
  OK, thanks - that was because this patch was supposed to be applied on
top of the one fixing the i_flags...

> I'll apply the below patch on top of it - please always put extern decls in
> header files so that the implementor and all users of the data/function
> always see the same declaration.
  Will do next time :)

								Bye
									Honza
-- 
Jan Kara <jack@suse.cz>
SuSE CR Labs