quota: Fix potential NULL pointer dereference
authorWang Jianjian <wangjianjian3@huawei.com>
Fri, 2 Feb 2024 08:18:52 +0000 (16:18 +0800)
committerJan Kara <jack@suse.cz>
Mon, 5 Feb 2024 14:57:34 +0000 (15:57 +0100)
commitd0aa72604fbd80c8aabb46eda00535ed35570f1f
tree8cccd6c0659e4113f3b21dc4f3900ee4b5d85a1e
parenta1e1b2becab7c0b23f18b7999a3b48f76210d3a6
quota: Fix potential NULL pointer dereference

Below race may cause NULL pointer dereference

P1 P2
dquot_free_inode quota_off
  drop_dquot_ref
   remove_dquot_ref
   dquots = i_dquot(inode)
  dquots = i_dquot(inode)
  srcu_read_lock
  dquots[cnt]) != NULL (1)
     dquots[type] = NULL (2)
  spin_lock(&dquots[cnt]->dq_dqb_lock) (3)
   ....

If dquot_free_inode(or other routines) checks inode's quota pointers (1)
before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer
dereference will be triggered.

So let's fix it by using a temporary pointer to avoid this issue.

Signed-off-by: Wang Jianjian <wangjianjian3@huawei.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20240202081852.2514092-1-wangjianjian3@huawei.com>
fs/quota/dquot.c