From 914141c17e08ecf4080ae0bd2fdedee0d8dedd18 Mon Sep 17 00:00:00 2001 From: ThangNN99 Date: Sun, 6 Sep 2026 15:08:21 +0700 Subject: [PATCH] gfs2: fix NULL deref in gfs2_quota_lock() for meta inodes gfs2_quota_hold() now treats a meta/system inode's NULL i_qadata as success, but gfs2_quota_lock() still dereferences it unconditionally afterwards. Bail out early when there is nothing to lock. Reported-by: syzbot+d84e35a320d14f8c270a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d84e35a320d14f8c270a Fixes: 0025112796287599dc79c822ed37124582a0d68a ("gfs2: No quotas for meta inodes") Signed-off-by: ThangNN99 Signed-off-by: Andreas Gruenbacher --- fs/gfs2/quota.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c index 52457f271f8b..b2984fb7b35c 100644 --- a/fs/gfs2/quota.c +++ b/fs/gfs2/quota.c @@ -1101,6 +1101,9 @@ int gfs2_quota_lock(struct gfs2_inode *ip, kuid_t uid, kgid_t gid) error = gfs2_quota_hold(ip, uid, gid); if (error) return error; + /* Meta inodes never get quota data (see gfs2_qa_get()); nothing to lock. */ + if (!ip->i_qadata) + return 0; sort(ip->i_qadata->qa_qd, ip->i_qadata->qa_qd_num, sizeof(struct gfs2_quota_data *), sort_qd, NULL);