[PATCH] gfs2: Fix refcount of quota data restored at mount

[Qing Zhang]

gfs2_quota_init() resets the lockref count to 0 despite setting
QDF_CHANGE, which owns a reference released by do_qc().  Quota syncing
can therefore consume a concurrent user's reference, leaving the
count at 0 and triggering the assertion in __qd_hold().

Keep the initial reference from qd_alloc().  During cleanup, clear
the in-memory change and slot state and drop the QDF_CHANGE reference
for objects with no other references.  Leave the on-disk quota change
records untouched for recovery on the next mount.

Fixes: bb73ae8ff394 ("gfs2: Fix initial quota data refcount")
Reported-by: syzbot+bad65435361712796381@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzbot.appspot.com/bug?extid=bad65435361712796381
Signed-off-by: Qing Zhang <diasyzhang@xxxxxxxxxxx>
---
If QDF_CHANGE remains set at teardown, a concurrent sysfs quota_refresh
can make cleanup skip a restored object during remount-ro or unmount.
The last external put then leaves the QDF_CHANGE reference behind,
whereas before this patch it could dispose of the object with the
journal shut down.  Feedback on handling this reference safely would
be appreciated.

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

 fs/gfs2/quota.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index b2984fb7b35c..29eb7adc4284 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -1470,7 +1470,6 @@ int gfs2_quota_init(struct gfs2_sbd *sdp)
 			if (qd == NULL)
 				goto fail_brelse;
 
-			qd->qd_lockref.count = 0;
 			set_bit(QDF_CHANGE, &qd->qd_flags);
 			qd->qd_change = qc_change;
 			qd->qd_slot = slot;
@@ -1542,6 +1541,12 @@ void gfs2_quota_cleanup(struct gfs2_sbd *sdp)
 	spin_lock(&qd_lock);
 	list_for_each_entry(qd, &sdp->sd_quota_list, qd_list) {
 		spin_lock(&qd->qd_lockref.lock);
+		if (qd->qd_lockref.count == 1 &&
+		    test_and_clear_bit(QDF_CHANGE, &qd->qd_flags)) {
+			qd->qd_change = 0;
+			qd->qd_slot_ref = 0;
+			qd->qd_lockref.count = 0;
+		}
 		if (qd->qd_lockref.count != 0) {
 			spin_unlock(&qd->qd_lockref.lock);
 			continue;
-- 
2.43.7