1 files changed, 28 insertions, 41 deletions

diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 1280eff8af56..4e6ef490619e 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -157,18 +157,11 @@ static struct btrfs_qgroup *add_qgroup_rb(struct btrfs_fs_info *fs_info,
         return qgroup;
 }
 
-/* must be called with qgroup_lock held */
-static int del_qgroup_rb(struct btrfs_fs_info *fs_info, u64 qgroupid)
+static void __del_qgroup_rb(struct btrfs_qgroup *qgroup)
 {
-        struct btrfs_qgroup *qgroup = find_qgroup_rb(fs_info, qgroupid);
         struct btrfs_qgroup_list *list;
 
-        if (!qgroup)
-                return -ENOENT;
-
-        rb_erase(&qgroup->node, &fs_info->qgroup_tree);
         list_del(&qgroup->dirty);
-
         while (!list_empty(&qgroup->groups)) {
                 list = list_first_entry(&qgroup->groups,
                                         struct btrfs_qgroup_list, next_group);
@@ -185,7 +178,18 @@ static int del_qgroup_rb(struct btrfs_fs_info *fs_info, u64 qgroupid)
                 kfree(list);
         }
         kfree(qgroup);
+}
 
+/* must be called with qgroup_lock held */
+static int del_qgroup_rb(struct btrfs_fs_info *fs_info, u64 qgroupid)
+{
+        struct btrfs_qgroup *qgroup = find_qgroup_rb(fs_info, qgroupid);
+
+        if (!qgroup)
+                return -ENOENT;
+
+        rb_erase(&qgroup->node, &fs_info->qgroup_tree);
+        __del_qgroup_rb(qgroup);
         return 0;
 }
 
@@ -394,8 +398,7 @@ next1:
                 if (ret == -ENOENT) {
                         printk(KERN_WARNING
                                 "btrfs: orphan qgroup relation 0x%llx->0x%llx\n",
-                                (unsigned long long)found_key.objectid,
-                                (unsigned long long)found_key.offset);
+                                found_key.objectid, found_key.offset);
                         ret = 0;        /* ignore the error */
                 }
                 if (ret)
@@ -428,39 +431,28 @@ out:
 }
 
 /*
- * This is only called from close_ctree() or open_ctree(), both in single-
- * treaded paths. Clean up the in-memory structures. No locking needed.
+ * This is called from close_ctree() or open_ctree() or btrfs_quota_disable(),
+ * first two are in single-threaded paths.And for the third one, we have set
+ * quota_root to be null with qgroup_lock held before, so it is safe to clean
+ * up the in-memory structures without qgroup_lock held.
  */
 void btrfs_free_qgroup_config(struct btrfs_fs_info *fs_info)
 {
         struct rb_node *n;
         struct btrfs_qgroup *qgroup;
-        struct btrfs_qgroup_list *list;
 
         while ((n = rb_first(&fs_info->qgroup_tree))) {
                 qgroup = rb_entry(n, struct btrfs_qgroup, node);
                 rb_erase(n, &fs_info->qgroup_tree);
-
-                while (!list_empty(&qgroup->groups)) {
-                        list = list_first_entry(&qgroup->groups,
-                                                struct btrfs_qgroup_list,
-                                                next_group);
-                        list_del(&list->next_group);
-                        list_del(&list->next_member);
-                        kfree(list);
-                }
-
-                while (!list_empty(&qgroup->members)) {
-                        list = list_first_entry(&qgroup->members,
-                                                struct btrfs_qgroup_list,
-                                                next_member);
-                        list_del(&list->next_group);
-                        list_del(&list->next_member);
-                        kfree(list);
-                }
-                kfree(qgroup);
+                __del_qgroup_rb(qgroup);
         }
+        /*
+         * we call btrfs_free_qgroup_config() when umounting
+         * filesystem and disabling quota, so we set qgroup_ulit
+         * to be null here to avoid double free.
+         */
         ulist_free(fs_info->qgroup_ulist);
+        fs_info->qgroup_ulist = NULL;
 }
 
 static int add_qgroup_relation_item(struct btrfs_trans_handle *trans,
@@ -946,13 +938,9 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans,
         fs_info->pending_quota_state = 0;
         quota_root = fs_info->quota_root;
         fs_info->quota_root = NULL;
-        btrfs_free_qgroup_config(fs_info);
         spin_unlock(&fs_info->qgroup_lock);
 
-        if (!quota_root) {
-                ret = -EINVAL;
-                goto out;
-        }
+        btrfs_free_qgroup_config(fs_info);
 
         ret = btrfs_clean_quota_tree(trans, quota_root);
         if (ret)
@@ -1174,7 +1162,7 @@ int btrfs_limit_qgroup(struct btrfs_trans_handle *trans,
         if (ret) {
                 fs_info->qgroup_flags |= BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT;
                 printk(KERN_INFO "unable to update quota limit for %llu\n",
-                       (unsigned long long)qgroupid);
+                       qgroupid);
         }
 
         spin_lock(&fs_info->qgroup_lock);
@@ -1884,10 +1872,9 @@ qgroup_rescan_leaf(struct btrfs_fs_info *fs_info, struct btrfs_path *path,
                                          path, 1, 0);
 
         pr_debug("current progress key (%llu %u %llu), search_slot ret %d\n",
-                 (unsigned long long)fs_info->qgroup_rescan_progress.objectid,
+                 fs_info->qgroup_rescan_progress.objectid,
                  fs_info->qgroup_rescan_progress.type,
-                 (unsigned long long)fs_info->qgroup_rescan_progress.offset,
-                 ret);
+                 fs_info->qgroup_rescan_progress.offset, ret);
 
         if (ret) {
                 /*