diff options
| author | Wang Jianjian <wangjianjian3@huawei.com> | 2024-02-02 16:18:52 +0800 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2024-03-26 18:19:46 -0400 |
| commit | 40a673b4b07efd6f74ff3ab60f38b26aa91ee5d5 (patch) | |
| tree | d1c77518ff79a4f6eb629f2adf5b4a446795e906 /include/linux | |
| parent | cfa7009c18af654fc2dc6566b23b8907414bd570 (diff) | |
quota: Fix potential NULL pointer dereference
[ Upstream commit d0aa72604fbd80c8aabb46eda00535ed35570f1f ]
Below race may cause NULL pointer dereference
P1 P2
dquot_free_inode quota_off
drop_dquot_ref
remove_dquot_ref
dquots = i_dquot(inode)
dquots = i_dquot(inode)
srcu_read_lock
dquots[cnt]) != NULL (1)
dquots[type] = NULL (2)
spin_lock(&dquots[cnt]->dq_dqb_lock) (3)
....
If dquot_free_inode(or other routines) checks inode's quota pointers (1)
before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer
dereference will be triggered.
So let's fix it by using a temporary pointer to avoid this issue.
Signed-off-by: Wang Jianjian <wangjianjian3@huawei.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20240202081852.2514092-1-wangjianjian3@huawei.com>
Stable-dep-of: 179b8c97ebf6 ("quota: Fix rcu annotations of inode dquot pointers")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include/linux')
0 files changed, 0 insertions, 0 deletions