From 0008baad6377c8195c63151f66cc01039919eab6 Mon Sep 17 00:00:00 2001 From: Andreas Gruenbacher Date: Wed, 26 Aug 2026 12:41:28 +0200 Subject: [PATCH] gfs2: No quotas for meta inodes Inodes on the meta filesystem (mount -o meta) can never have quotas, so skip them entirely in the quota code. This avoids allocating ip->i_qadata unnecessarily. Without this fix, unlinking meta inodes like "statfs" on the meta filesystem will result in a NULL pointer dereference at unmount time: gfs2_evict_inode() -> gfs2_dinode_dealloc() -> gfs2_quota_hold() -> qdsb_get() -> slot_get() -> find_first_zero_bit(sd_quota_bitmap) Unlinking inodes on the meta filesystem isn't a useful operation, but it still shouldn't cause the kernel to misbehave. Reported-by: syzbot+cb79de2cc8b76fbf474f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cb79de2cc8b76fbf474f Signed-off-by: Andreas Gruenbacher --- fs/gfs2/quota.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c index b62431724eea..dbfc21693dd5 100644 --- a/fs/gfs2/quota.c +++ b/fs/gfs2/quota.c @@ -562,6 +562,8 @@ int gfs2_qa_get(struct gfs2_inode *ip) if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF) return 0; + if (ip->i_diskflags & GFS2_DIF_SYSTEM) + return 0; spin_lock(&inode->i_lock); if (ip->i_qadata == NULL) { @@ -605,7 +607,7 @@ int gfs2_quota_hold(struct gfs2_inode *ip, kuid_t uid, kgid_t gid) return 0; error = gfs2_qa_get(ip); - if (error) + if (error || !ip->i_qadata) return error; qd = ip->i_qadata->qa_qd;