From nobody Fri Dec 19 20:13:33 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 75E61296BCA; Sun, 24 Mar 2024 23:52:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1711324326; cv=none; b=cOygnm38zv/dZBcHd9m3qDrAzDCv+aoWycRsIUDQxbvy77MIqhsSPjfYPwDUvv3N20gCfQz5HWuSzxJZRHaUk3C/dXHmUFcUOiAPoIJcnWGFcBDU/Ouz5D+9bEgzehmWefrqUN4lkpiqtOa6eeuiBUeJendr0FD6v9TVqfFZ/5U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1711324326; c=relaxed/simple; bh=paOl2NWjP3PETxonbQe2C2nz6fAWC1jeqqa1EuP7GiE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=h6T69SjEzDCBqZj4hiMoGW5aEkc4P0G9Vxupho/hnJPqEnEY5gCIzk/Ccde2+5QZ0m3MNmR1igxvHuBdbbOC2OBgfOhIJgS2PV7RvHr6LtOdAfEOEbkEfb4IEw9oaLHo2KV5tgJ4k2tcKDSAu7GtWz5nO+x5GUE6rH5I6ae1AN0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=cL8glapf; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="cL8glapf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 795EBC433C7; Sun, 24 Mar 2024 23:52:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1711324325; bh=paOl2NWjP3PETxonbQe2C2nz6fAWC1jeqqa1EuP7GiE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cL8glapfa1JAMD4NEcUAIUaBohlF3MIx2vXDNCnZkQjl0TngO3o5idHQuFhx/AyHT 5ZeuKzyj+g78twbkSQqA+AilfcU1nM5dzE2oJwrXh9E9VX62+6WOcy/WM+lFZkEHHd r9ATjkRL4J2rYxKJ7zQeU+rdHx7yHZbeqgtM93Ga9dYs+4sq04K7pxQbSsBbkDW3wn 0o/c2uCJDPCFVybrjet9V8GsJO0TBWKL/IqLtZOiWweRUsYUPtcm/5LBjse3wIMSdL kjOaiupOjJ6lnh+c7+SzQeaOvEgPaLD8zvmEuT2Ti3g3KPcM669pTmvhKvhZ4wxKT/ YC3UXANkYWIdw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Wang Jianjian , Jan Kara , Sasha Levin Subject: [PATCH 4.19 096/148] quota: Fix potential NULL pointer dereference Date: Sun, 24 Mar 2024 19:49:20 -0400 Message-ID: <20240324235012.1356413-97-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240324235012.1356413-1-sashal@kernel.org> References: <20240324235012.1356413-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Wang Jianjian [ Upstream commit d0aa72604fbd80c8aabb46eda00535ed35570f1f ] Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots =3D i_dquot(inode) dquots =3D i_dquot(inode) srcu_read_lock dquots[cnt]) !=3D NULL (1) dquots[type] =3D NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) .... If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered. So let's fix it by using a temporary pointer to avoid this issue. Signed-off-by: Wang Jianjian Signed-off-by: Jan Kara Message-Id: <20240202081852.2514092-1-wangjianjian3@huawei.com> Stable-dep-of: 179b8c97ebf6 ("quota: Fix rcu annotations of inode dquot poi= nters") Signed-off-by: Sasha Levin --- fs/quota/dquot.c | 98 ++++++++++++++++++++++++++++-------------------- 1 file changed, 57 insertions(+), 41 deletions(-) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index dd9c381b874fd..133ca865de976 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -399,15 +399,17 @@ int dquot_mark_dquot_dirty(struct dquot *dquot) EXPORT_SYMBOL(dquot_mark_dquot_dirty); =20 /* Dirtify all the dquots - this can block when journalling */ -static inline int mark_all_dquot_dirty(struct dquot * const *dquot) +static inline int mark_all_dquot_dirty(struct dquot * const *dquots) { int ret, err, cnt; + struct dquot *dquot; =20 ret =3D err =3D 0; for (cnt =3D 0; cnt < MAXQUOTAS; cnt++) { - if (dquot[cnt]) + dquot =3D srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) /* Even in case of error we have to continue */ - ret =3D mark_dquot_dirty(dquot[cnt]); + ret =3D mark_dquot_dirty(dquot); if (!err) err =3D ret; } @@ -1674,6 +1676,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t = number, int flags) struct dquot_warn warn[MAXQUOTAS]; int reserve =3D flags & DQUOT_SPACE_RESERVE; struct dquot **dquots; + struct dquot *dquot; =20 if (!inode_quota_active(inode)) { if (reserve) { @@ -1693,27 +1696,26 @@ int __dquot_alloc_space(struct inode *inode, qsize_= t number, int flags) index =3D srcu_read_lock(&dquot_srcu); spin_lock(&inode->i_lock); for (cnt =3D 0; cnt < MAXQUOTAS; cnt++) { - if (!dquots[cnt]) + dquot =3D srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; if (reserve) { - ret =3D dquot_add_space(dquots[cnt], 0, number, flags, - &warn[cnt]); + ret =3D dquot_add_space(dquot, 0, number, flags, &warn[cnt]); } else { - ret =3D dquot_add_space(dquots[cnt], number, 0, flags, - &warn[cnt]); + ret =3D dquot_add_space(dquot, number, 0, flags, &warn[cnt]); } if (ret) { /* Back out changes we already did */ for (cnt--; cnt >=3D 0; cnt--) { - if (!dquots[cnt]) + dquot =3D srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); + spin_lock(&dquot->dq_dqb_lock); if (reserve) - dquot_free_reserved_space(dquots[cnt], - number); + dquot_free_reserved_space(dquot, number); else - dquot_decr_space(dquots[cnt], number); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + dquot_decr_space(dquot, number); + spin_unlock(&dquot->dq_dqb_lock); } spin_unlock(&inode->i_lock); goto out_flush_warn; @@ -1744,6 +1746,7 @@ int dquot_alloc_inode(struct inode *inode) int cnt, ret =3D 0, index; struct dquot_warn warn[MAXQUOTAS]; struct dquot * const *dquots; + struct dquot *dquot; =20 if (!inode_quota_active(inode)) return 0; @@ -1754,17 +1757,19 @@ int dquot_alloc_inode(struct inode *inode) index =3D srcu_read_lock(&dquot_srcu); spin_lock(&inode->i_lock); for (cnt =3D 0; cnt < MAXQUOTAS; cnt++) { - if (!dquots[cnt]) + dquot =3D srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - ret =3D dquot_add_inodes(dquots[cnt], 1, &warn[cnt]); + ret =3D dquot_add_inodes(dquot, 1, &warn[cnt]); if (ret) { for (cnt--; cnt >=3D 0; cnt--) { - if (!dquots[cnt]) + dquot =3D srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; /* Back out changes we already did */ - spin_lock(&dquots[cnt]->dq_dqb_lock); - dquot_decr_inodes(dquots[cnt], 1); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + spin_lock(&dquot->dq_dqb_lock); + dquot_decr_inodes(dquot, 1); + spin_unlock(&dquot->dq_dqb_lock); } goto warn_put_all; } @@ -1786,6 +1791,7 @@ EXPORT_SYMBOL(dquot_alloc_inode); int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) { struct dquot **dquots; + struct dquot *dquot; int cnt, index; =20 if (!inode_quota_active(inode)) { @@ -1801,9 +1807,8 @@ int dquot_claim_space_nodirty(struct inode *inode, qs= ize_t number) spin_lock(&inode->i_lock); /* Claim reserved quotas to allocated quotas */ for (cnt =3D 0; cnt < MAXQUOTAS; cnt++) { - if (dquots[cnt]) { - struct dquot *dquot =3D dquots[cnt]; - + dquot =3D srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) { spin_lock(&dquot->dq_dqb_lock); if (WARN_ON_ONCE(dquot->dq_dqb.dqb_rsvspace < number)) number =3D dquot->dq_dqb.dqb_rsvspace; @@ -1828,6 +1833,7 @@ EXPORT_SYMBOL(dquot_claim_space_nodirty); void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) { struct dquot **dquots; + struct dquot *dquot; int cnt, index; =20 if (!inode_quota_active(inode)) { @@ -1843,9 +1849,8 @@ void dquot_reclaim_space_nodirty(struct inode *inode,= qsize_t number) spin_lock(&inode->i_lock); /* Claim reserved quotas to allocated quotas */ for (cnt =3D 0; cnt < MAXQUOTAS; cnt++) { - if (dquots[cnt]) { - struct dquot *dquot =3D dquots[cnt]; - + dquot =3D srcu_dereference(dquots[cnt], &dquot_srcu); + if (dquot) { spin_lock(&dquot->dq_dqb_lock); if (WARN_ON_ONCE(dquot->dq_dqb.dqb_curspace < number)) number =3D dquot->dq_dqb.dqb_curspace; @@ -1872,6 +1877,7 @@ void __dquot_free_space(struct inode *inode, qsize_t = number, int flags) unsigned int cnt; struct dquot_warn warn[MAXQUOTAS]; struct dquot **dquots; + struct dquot *dquot; int reserve =3D flags & DQUOT_SPACE_RESERVE, index; =20 if (!inode_quota_active(inode)) { @@ -1892,17 +1898,18 @@ void __dquot_free_space(struct inode *inode, qsize_= t number, int flags) int wtype; =20 warn[cnt].w_type =3D QUOTA_NL_NOWARN; - if (!dquots[cnt]) + dquot =3D srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); - wtype =3D info_bdq_free(dquots[cnt], number); + spin_lock(&dquot->dq_dqb_lock); + wtype =3D info_bdq_free(dquot, number); if (wtype !=3D QUOTA_NL_NOWARN) - prepare_warning(&warn[cnt], dquots[cnt], wtype); + prepare_warning(&warn[cnt], dquot, wtype); if (reserve) - dquot_free_reserved_space(dquots[cnt], number); + dquot_free_reserved_space(dquot, number); else - dquot_decr_space(dquots[cnt], number); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + dquot_decr_space(dquot, number); + spin_unlock(&dquot->dq_dqb_lock); } if (reserve) *inode_reserved_space(inode) -=3D number; @@ -1927,6 +1934,7 @@ void dquot_free_inode(struct inode *inode) unsigned int cnt; struct dquot_warn warn[MAXQUOTAS]; struct dquot * const *dquots; + struct dquot *dquot; int index; =20 if (!inode_quota_active(inode)) @@ -1937,16 +1945,16 @@ void dquot_free_inode(struct inode *inode) spin_lock(&inode->i_lock); for (cnt =3D 0; cnt < MAXQUOTAS; cnt++) { int wtype; - warn[cnt].w_type =3D QUOTA_NL_NOWARN; - if (!dquots[cnt]) + dquot =3D srcu_dereference(dquots[cnt], &dquot_srcu); + if (!dquot) continue; - spin_lock(&dquots[cnt]->dq_dqb_lock); - wtype =3D info_idq_free(dquots[cnt], 1); + spin_lock(&dquot->dq_dqb_lock); + wtype =3D info_idq_free(dquot, 1); if (wtype !=3D QUOTA_NL_NOWARN) - prepare_warning(&warn[cnt], dquots[cnt], wtype); - dquot_decr_inodes(dquots[cnt], 1); - spin_unlock(&dquots[cnt]->dq_dqb_lock); + prepare_warning(&warn[cnt], dquot, wtype); + dquot_decr_inodes(dquot, 1); + spin_unlock(&dquot->dq_dqb_lock); } spin_unlock(&inode->i_lock); mark_all_dquot_dirty(dquots); @@ -1973,7 +1981,7 @@ int __dquot_transfer(struct inode *inode, struct dquo= t **transfer_to) qsize_t rsv_space =3D 0; qsize_t inode_usage =3D 1; struct dquot *transfer_from[MAXQUOTAS] =3D {}; - int cnt, ret =3D 0; + int cnt, index, ret =3D 0; char is_valid[MAXQUOTAS] =3D {}; struct dquot_warn warn_to[MAXQUOTAS]; struct dquot_warn warn_from_inodes[MAXQUOTAS]; @@ -2062,8 +2070,16 @@ int __dquot_transfer(struct inode *inode, struct dqu= ot **transfer_to) spin_unlock(&inode->i_lock); spin_unlock(&dq_data_lock); =20 + /* + * These arrays are local and we hold dquot references so we don't need + * the srcu protection but still take dquot_srcu to avoid warning in + * mark_all_dquot_dirty(). + */ + index =3D srcu_read_lock(&dquot_srcu); mark_all_dquot_dirty(transfer_from); mark_all_dquot_dirty(transfer_to); + srcu_read_unlock(&dquot_srcu, index); + flush_warnings(warn_to); flush_warnings(warn_from_inodes); flush_warnings(warn_from_space); --=20 2.43.0