Jan Kara 4480120a6c quota: Fix race between dqput() and dquot_scan_active() ...

commit 1362f4ea20 upstream.

Currently last dqput() can race with dquot_scan_active() causing it to
call callback for an already deactivated dquot. The race is as follows:

CPU1					CPU2
  dqput()
    spin_lock(&dq_list_lock);
    if (atomic_read(&dquot->dq_count) > 1) {
     - not taken
    if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
      spin_unlock(&dq_list_lock);
      ->release_dquot(dquot);
        if (atomic_read(&dquot->dq_count) > 1)
         - not taken
					  dquot_scan_active()
					    spin_lock(&dq_list_lock);
					    if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
					     - not taken
					    atomic_inc(&dquot->dq_count);
					    spin_unlock(&dq_list_lock);
        - proceeds to release dquot
					    ret = fn(dquot, priv);
					     - called for inactive dquot

Fix the problem by making sure possible ->release_dquot() is finished by
the time we call the callback and new calls to it will notice reference
dquot_scan_active() has taken and bail out.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2014-03-06 21:30:12 -08:00

..

9p

aio: don't include aio.h in sched.h

2013-05-07 20:16:25 -07:00

adfs

fs: Limit sys_mount to only request filesystem modules.

2013-03-03 19:36:31 -08:00

affs

fs: Limit sys_mount to only request filesystem modules.

2013-03-03 19:36:31 -08:00

afs

aio: don't include aio.h in sched.h

2013-05-07 20:16:25 -07:00

autofs4

autofs - remove autofs dentry mount check

2013-05-06 13:06:59 -07:00

befs

befs_readdir(): do not increment ->f_pos if filldir tells us to stop

2013-05-31 15:17:56 -04:00

bfs

fs: Limit sys_mount to only request filesystem modules.

2013-03-03 19:36:31 -08:00

btrfs

fs: fix iversion handling

2014-03-06 21:30:06 -08:00

cachefiles

lift sb_start_write() out of ->write()

2013-04-09 14:12:56 -04:00

ceph

ceph: allow sync_read/write return partial successed size of read/write.

2014-01-09 12:24:25 -08:00

cifs

CIFS: Fix too big maxBuf size for SMB3 mounts

2014-03-06 21:30:02 -08:00

coda

lift sb_start_write() out of ->write()

2013-04-09 14:12:56 -04:00

configfs

configfs: fix race between dentry put and lookup

2013-11-29 11:11:53 -08:00

cramfs

fs: Limit sys_mount to only request filesystem modules.

2013-03-03 19:36:31 -08:00

debugfs

debugfs: debugfs_remove_recursive() must not rely on list_empty(d_subdirs)

2013-08-14 22:59:10 -07:00

devpts

devpts: plug the memory leak in kill_sb

2013-12-04 10:55:49 -08:00

dlm

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2013-05-01 14:08:52 -07:00

ecryptfs

ecryptfs: Fix memory leakage in keystore.c

2013-11-13 12:05:31 +09:00

efivarfs

efivarfs: Never return ENOENT from firmware again

2013-05-13 20:12:10 +01:00

efs

fs: Limit sys_mount to only request filesystem modules.

2013-03-03 19:36:31 -08:00

exofs

ore: Fix wrong math in allocation of per device BIO

2014-02-13 13:48:00 -08:00

exportfs

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

ext2

aio: don't include aio.h in sched.h

2013-05-07 20:16:25 -07:00

ext3

ext3,ext4: don't mess with dir_file->f_pos in htree_dirblock_to_tree()

2013-07-21 18:21:23 -07:00

ext4

fs: fix iversion handling

2014-03-06 21:30:06 -08:00

f2fs

Merge tag 'f2fs-for-v3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

2013-05-08 15:11:48 -07:00

fat

fat: fix possible overflow for fat_clusters

2013-05-24 16:22:50 -07:00

freevxfs

fs: Readd the fs module aliases.

2013-03-12 18:55:21 -07:00

fscache

fs/fscache/stats.c: fix memory leak

2013-04-29 15:54:27 -07:00

fuse

fuse: fix pipe_buf_operations

2014-02-13 13:47:59 -08:00

gfs2

GFS2: Increase i_writecount during gfs2_setattr_chown

2014-01-25 08:27:11 -08:00

hfs

hfs: avoid crash in hfs_bnode_create

2013-05-24 16:22:51 -07:00

hfsplus

aio: don't include aio.h in sched.h

2013-05-07 20:16:25 -07:00

hostfs

hostfs: use kmalloc instead of kzalloc

2013-05-04 15:48:45 -04:00

hpfs

hpfs: better test for errors

2013-07-13 11:42:26 -07:00

hppfs

hppfs: get rid of ->fsync()

2013-04-29 15:41:42 -04:00

hugetlbfs

cope with potentially long ->d_dname() output for shmem/hugetlb

2013-10-18 07:45:45 -07:00

isofs

isofs: Refuse RW mount of the filesystem instead of making it RO

2013-09-26 17:18:28 -07:00

jbd

Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

2013-05-03 09:56:25 -07:00

jbd2

jbd2: don't BUG but return ENOSPC if a handle runs out of space

2014-01-09 12:24:24 -08:00

jffs2

fs: Limit sys_mount to only request filesystem modules.

2013-03-03 19:36:31 -08:00

jfs

jfs: fix error path in ialloc

2013-11-13 12:05:31 +09:00

lockd

lockd: send correct lock when granting a delayed lock.

2014-02-22 12:41:27 -08:00

logfs

block: Remove bi_idx references

2013-03-23 14:15:31 -07:00

minix

fs: Limit sys_mount to only request filesystem modules.

2013-03-03 19:36:31 -08:00

ncpfs

ncpfs: fix rmdir returns Device or resource busy

2013-06-07 12:15:38 -04:00

nfs

pnfs: Proper delay for NFS4ERR_RECALLCONFLICT in layout_get_done

2014-02-13 13:48:01 -08:00

nfs_common

…

nfsd

nfsd: when reusing an existing repcache entry, unhash it first

2013-12-20 07:45:08 -08:00

nilfs2

nilfs2: fix segctor bug that causes file system corruption

2014-01-25 08:27:12 -08:00

nls

…

notify

compat: fix sys_fanotify_mark

2014-02-13 13:48:00 -08:00

ntfs

aio: don't include aio.h in sched.h

2013-05-07 20:16:25 -07:00

ocfs2

ocfs2: fix the end cluster offset of FIEMAP

2013-09-26 17:18:28 -07:00

omfs

fs: Limit sys_mount to only request filesystem modules.

2013-03-03 19:36:31 -08:00

openpromfs

fs: Limit sys_mount to only request filesystem modules.

2013-03-03 19:36:31 -08:00

proc

proc: Restrict mounting the proc filesystem

2013-09-26 17:18:28 -07:00

pstore

Merge tag 'please-pull-pstore' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux

2013-05-09 16:42:10 -07:00

qnx4

fs: Limit sys_mount to only request filesystem modules.

2013-03-03 19:36:31 -08:00

qnx6

qnx6: qnx6_readdir() has a braino in pos calculation

2013-05-31 15:17:31 -04:00

quota

quota: Fix race between dqput() and dquot_scan_active()

2014-03-06 21:30:12 -08:00

ramfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-02-26 20:16:07 -08:00

reiserfs

reiserfs: fix deadlock in umount

2013-08-14 22:59:10 -07:00

romfs

romfs: fix nommu map length to keep inside filesystem

2013-04-29 09:17:57 +10:00

squashfs

fs: Limit sys_mount to only request filesystem modules. (Part 3)

2013-03-11 07:09:48 -07:00

sysfs

sysfs: check if one entry has been removed before freeing

2013-04-05 15:35:52 -07:00

sysv

sysv: Add forgotten superblock lock init for v7 fs

2013-10-05 07:13:09 -07:00

ubifs

UBIFS: correct mount message

2013-07-21 18:21:36 -07:00

udf

udf: Refuse RW mount of the filesystem instead of making it RO

2013-10-01 09:17:48 -07:00

ufs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2013-04-30 09:36:50 -07:00

xfs

xfs: underflow bug in xfs_attrlist_by_handle()

2013-12-20 07:45:08 -08:00

aio.c

aio: restore locking of ioctx list on removal

2013-12-08 07:29:27 -08:00

anon_inodes.c

get_empty_filp()/alloc_file() leave both ->f_pos and ->f_version zero

2013-02-26 02:46:11 -05:00

attr.c

fs: fix iversion handling

2014-03-06 21:30:06 -08:00

bad_inode.c

…

binfmt_aout.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-05-01 17:51:54 -07:00

binfmt_elf_fdpic.c

Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc

2013-05-02 10:16:16 -07:00

binfmt_elf.c

fs/binfmt_elf.c: prevent a coredump with a large vm_map_count from Oopsing

2013-10-13 16:08:31 -07:00

binfmt_em86.c

…

binfmt_flat.c

new helper: read_code()

2013-04-29 15:40:23 -04:00

binfmt_misc.c

binfmt_misc: reuse string_unescape_inplace()

2013-04-30 17:04:03 -07:00

binfmt_script.c

…

binfmt_som.c

…

bio-integrity.c

block: Fix nr_vecs for inline integrity vectors

2014-02-22 12:41:28 -08:00

bio.c

block: Fix bio_copy_data()

2013-10-05 07:13:09 -07:00

block_dev.c

writeback: Fix periodic writeback after fs mount

2013-07-28 16:29:40 -07:00

buffer.c

mm: __set_page_dirty uses spin_lock_irqsave instead of spin_lock_irq

2014-02-20 11:06:11 -08:00

char_dev.c

…

compat_binfmt_elf.c

…

compat_ioctl.c

Removed unused typedef to avoid "unused local typedef" warnings.

2013-05-04 15:03:05 -04:00

compat.c

aio: don't include aio.h in sched.h

2013-05-07 20:16:25 -07:00

coredump.c

do_coredump(): don't wait for thaw if coredump has already been interrupted

2013-05-04 14:45:54 -04:00

coredump.h

…

dcache.c

vfs: In d_path don't call d_dname on a mount point

2014-01-25 08:27:11 -08:00

dcookies.c

fs/compat: fix lookup_dcookie() parameter handling

2014-02-13 13:48:00 -08:00

direct-io.c

Merge branch 'for-3.10/core' of git://git.kernel.dk/linux-block

2013-05-08 10:13:35 -07:00

drop_caches.c

…

eventfd.c

…

eventpoll.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal

2013-05-01 07:21:43 -07:00

exec.c

exec/ptrace: fix get_dumpable() incorrect tests

2013-11-29 11:11:44 -08:00

fcntl.c

new helper: file_inode(file)

2013-02-22 23:31:31 -05:00

fhandle.c

…

file_table.c

fput: task_work_add() can fail if the caller has passed exit_task_work()

2013-06-15 05:39:08 +04:00

file.c

fs/file.c:fdtable: avoid triggering OOMs from alloc_fdmem

2014-02-22 12:41:25 -08:00

filesystems.c

fs: Limit sys_mount to only request filesystem modules.

2013-03-03 19:36:31 -08:00

fs_struct.c

constify path_get/path_put and fs_struct.c stuff

2013-03-01 23:51:07 -05:00

fs-writeback.c

writeback: Fix data corruption on NFS

2014-01-25 08:27:11 -08:00

generic_acl.c

…

inode.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-05-01 17:51:54 -07:00

internal.h

splice: don't pass the address of ->f_pos to methods

2013-06-20 19:02:45 +04:00

ioctl.c

new helper: file_inode(file)

2013-02-22 23:31:31 -05:00

ioprio.c

…

Kconfig

efivarfs: Move to fs/efivarfs

2013-04-17 13:25:09 +01:00

Kconfig.binfmt

fs: make binfmt support for #! scripts modular and removable

2013-04-30 17:04:04 -07:00

libfs.c

…

locks.c

new helper: file_inode(file)

2013-02-22 23:31:31 -05:00

Makefile

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-05-01 17:51:54 -07:00

mbcache.c

…

mount.h

vfs: Is mounted should be testing mnt_ns for NULL or error.

2014-02-06 11:08:16 -08:00

mpage.c

…

namei.c

audit: add child record before the create to handle case where create fails

2013-12-04 10:57:03 -08:00

namespace.c

VFS: collect_mounts() should return an ERR_PTR

2013-08-29 09:47:35 -07:00

no-block.c

…

open.c

make SYSCALL_DEFINE<n>-generated wrappers do asmlinkage_protect

2013-03-03 22:58:33 -05:00

pipe.c

vfs: fix subtle use-after-free of pipe_inode_info

2013-12-11 22:36:26 -08:00

pnode.c

vfs: Fix invalid ida_remove() call

2013-05-31 15:16:33 -04:00

pnode.h

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-05-01 17:51:54 -07:00

posix_acl.c

…

proc_namespace.c

…

read_write.c

fs/compat: fix parameter handling for compat readv/writev syscalls

2014-02-13 13:48:00 -08:00

readdir.c

new helper: file_inode(file)

2013-02-22 23:31:31 -05:00

select.c

…

seq_file.c

seq_file: always update file->f_pos in seq_lseek()

2013-11-13 12:05:34 +09:00

signalfd.c

switch signalfd{,4}() to COMPAT_SYSCALL_DEFINE

2013-03-03 22:58:46 -05:00

splice.c

fuse: fix pipe_buf_operations

2014-02-13 13:47:59 -08:00

stack.c

…

stat.c

switch vfs_getattr() to struct path

2013-02-26 02:46:08 -05:00

statfs.c

vfs: allow O_PATH file descriptors for fstatfs()

2013-10-18 07:45:44 -07:00

super.c

livelock avoidance in sget()

2013-08-04 16:51:15 +08:00

sync.c

teach SYSCALL_DEFINE<n> how to deal with long long/unsigned long long

2013-03-03 22:46:22 -05:00

timerfd.c

compat: restore timerfd settime and gettime compat syscalls

2013-03-02 09:35:13 -05:00

utimes.c

…

xattr_acl.c

…

xattr.c

…