github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

gfs2: fix NULL deref in gfs2_quota_lock() for meta inodes

Browse Source 
gfs2_quota_hold() now treats a meta/system inode's NULL i_qadata as
success, but gfs2_quota_lock() still dereferences it unconditionally
afterwards. Bail out early when there is nothing to lock.

Reported-by: syzbot+d84e35a320d14f8c270a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d84e35a320d14f8c270a
Fixes: 0025112796287599dc79c822ed37124582a0d68a ("gfs2: No quotas for meta inodes")
Signed-off-by: ThangNN99 <ngocthang2710.1999@gmail.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
This commit is contained in:
ThangNN99 2026-09-06 15:08:21 +07:00 committed by Andreas Gruenbacher
parent 277536c882
commit 914141c17e
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fs/gfs2/quota.c
View File

@ -1101,6 +1101,9 @@ int gfs2_quota_lock(struct gfs2_inode *ip, kuid_t uid, kgid_t gid)
error = gfs2_quota_hold(ip, uid, gid);
if (error)
return error;
/* Meta inodes never get quota data (see gfs2_qa_get()); nothing to lock. */
if (!ip->i_qadata)
return 0;
sort(ip->i_qadata->qa_qd, ip->i_qadata->qa_qd_num,
sizeof(struct gfs2_quota_data *), sort_qd, NULL);