Re: [PATCH 1/2] xfs: fix ilock leak on error in xfs_dq_get_next_id

On Mon, Jul 27, 2026 at 10:38:48AM +0800, Long Li wrote:
> xfs_dq_get_next_id() takes the quota inode ILOCK before calling
> xfs_iread_extents().  If xfs_iread_extents() fails, the function returns
> immediately without releasing the lock, leaking the quota inode ILOCK.
> This can leave the quota inode locked and cause subsequent quota
> operations to hang.
> 
> Fix this by jumping to a common unlock path on error instead of returning
> directly.
> 
> Fixes: bda250dbaf39f ("xfs: rewrite xfs_dq_get_next_id using xfs_iext_lookup_extent")
> Cc: <[email protected]> # v4.12
> Signed-off-by: Long Li <[email protected]>

Yeah, that's a bug!
Reviewed-by: "Darrick J. Wong" <[email protected]>

--D

> ---
>  fs/xfs/xfs_dquot.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
> index c311f61d9554..b4f6c594808c 100644
> --- a/fs/xfs/xfs_dquot.c
> +++ b/fs/xfs/xfs_dquot.c
> @@ -778,7 +778,7 @@ xfs_dq_get_next_id(
>  	lock_flags = xfs_ilock_data_map_shared(quotip);
>  	error = xfs_iread_extents(NULL, quotip, XFS_DATA_FORK);
>  	if (error)
> -		return error;
> +		goto out_unlock;
>  
>  	if (xfs_iext_lookup_extent(quotip, &quotip->i_df, start, &cur, &got)) {
>  		/* contiguous chunk, bump startoff for the id calculation */
> @@ -789,6 +789,7 @@ xfs_dq_get_next_id(
>  		error = -ENOENT;
>  	}
>  
> +out_unlock:
>  	xfs_iunlock(quotip, lock_flags);
>  
>  	return error;
> -- 
> 2.52.0
> 
>