Patch "xfs: release the dquot buf outside of qli_lock" has been added to the 6.12-stable tree

This is a note to let you know that I've just added the patch titled

    xfs: release the dquot buf outside of qli_lock

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     xfs-release-the-dquot-buf-outside-of-qli_lock.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.


From [email protected] Fri Feb  7 20:28:43 2025
From: "Darrick J. Wong" <[email protected]>
Date: Fri, 07 Feb 2025 11:28:38 -0800
Subject: xfs: release the dquot buf outside of qli_lock
To: [email protected], [email protected]
Cc: [email protected], [email protected], [email protected]
Message-ID: <173895601550.3373740.12378168291194427407.stgit@frogsfrogsfrogs>

From: Darrick J. Wong <[email protected]>

commit 1aacd3fac248902ea1f7607f2d12b93929a4833b upstream

Lai Yi reported a lockdep complaint about circular locking:

 Chain exists of:
   &lp->qli_lock --> &bch->bc_lock --> &l->lock

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(&l->lock);
                                lock(&bch->bc_lock);
                                lock(&l->lock);
   lock(&lp->qli_lock);

I /think/ the problem here is that xfs_dquot_attach_buf during
quotacheck will release the buffer while it's holding the qli_lock.
Because this is a cached buffer, xfs_buf_rele_cached takes b_lock before
decrementing b_hold.  Other threads have taught lockdep that a locking
dependency chain is bp->b_lock -> bch->bc_lock -> l(ru)->lock; and that
another chain is l(ru)->lock -> lp->qli_lock.  Hence we do not want to
take b_lock while holding qli_lock.

Reported-by: [email protected]
Cc: <[email protected]> # v6.13-rc3
Fixes: ca378189fdfa89 ("xfs: convert quotacheck to attach dquot buffers")
Signed-off-by: "Darrick J. Wong" <[email protected]>
Reviewed-by: Christoph Hellwig <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
 fs/xfs/xfs_dquot.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)


--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -1308,7 +1308,8 @@ out_abort:
 
 /*
  * Attach a dquot buffer to this dquot to avoid allocating a buffer during a
- * dqflush, since dqflush can be called from reclaim context.
+ * dqflush, since dqflush can be called from reclaim context.  Caller must hold
+ * the dqlock.
  */
 int
 xfs_dquot_attach_buf(
@@ -1329,13 +1330,16 @@ xfs_dquot_attach_buf(
 			return error;
 
 		/*
-		 * Attach the dquot to the buffer so that the AIL does not have
-		 * to read the dquot buffer to push this item.
+		 * Hold the dquot buffer so that we retain our ref to it after
+		 * detaching it from the transaction, then give that ref to the
+		 * dquot log item so that the AIL does not have to read the
+		 * dquot buffer to push this item.
 		 */
 		xfs_buf_hold(bp);
+		xfs_trans_brelse(tp, bp);
+
 		spin_lock(&qlip->qli_lock);
 		lip->li_buf = bp;
-		xfs_trans_brelse(tp, bp);
 	}
 	qlip->qli_dirty = true;
 	spin_unlock(&qlip->qli_lock);


Patches currently in stable-queue which might be from [email protected] are

queue-6.12/xfs-lock-dquot-buffer-before-detaching-dquot-from-b_li_list.patch
queue-6.12/xfs-attach-dquot-buffer-to-dquot-log-item-buffer.patch
queue-6.12/xfs-report-realtime-block-quota-limits-on-realtime-d.patch
queue-6.12/xfs-don-t-over-report-free-space-or-inodes-in-statvf.patch
queue-6.12/xfs-convert-quotacheck-to-attach-dquot-buffers.patch
queue-6.12/xfs-don-t-lose-solo-dquot-update-transactions.patch
queue-6.12/xfs-avoid-nested-calls-to-__xfs_trans_commit.patch
queue-6.12/xfs-release-the-dquot-buf-outside-of-qli_lock.patch
queue-6.12/xfs-clean-up-log-item-accesses-in-xfs_qm_dqflush-_done.patch
queue-6.12/xfs-don-t-lose-solo-superblock-counter-update-transactions.patch
queue-6.12/xfs-add-error-handling-for-xfs_reflink_cancel_cow_range.patch
queue-6.12/xfs-propagate-errors-from-xfs_reflink_cancel_cow_range-in-xfs_dax_write_iomap_end.patch
queue-6.12/xfs-fix-mount-hang-during-primary-superblock-recovery-failure.patch
queue-6.12/xfs-don-t-call-remap_verify_area-with-sb-write-protection-held.patch
queue-6.12/xfs-separate-dquot-buffer-reads-from-xfs_dqflush.patch