Wang Jianjian d0aa72604f quota: Fix potential NULL pointer dereference ... Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) .... If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered. So let's fix it by using a temporary pointer to avoid this issue. Signed-off-by: Wang Jianjian <wangjianjian3@huawei.com> Signed-off-by: Jan Kara <jack@suse.cz> Message-Id: <20240202081852.2514092-1-wangjianjian3@huawei.com>		2024-02-05 15:57:34 +01:00
..
compat.h	quota: simplify the quotactl compat handling	2020-09-17 13:00:46 -04:00
dquot.c	quota: Fix potential NULL pointer dereference	2024-02-05 15:57:34 +01:00
Kconfig	quota: mark PRINT_QUOTA_WARNING as BROKEN	2023-04-14 13:06:50 +02:00
kqid.c
Makefile	quota: simplify the quotactl compat handling	2020-09-17 13:00:46 -04:00
netlink.c
quota_tree.c	quota: Drop GFP_NOFS instances under dquot->dq_lock and dqio_sem	2024-01-23 19:21:11 +01:00
quota_tree.h
quota_v1.c	quota: Set nofs allocation context when acquiring dqio_sem	2024-01-23 19:21:11 +01:00
quota_v2.c	quota: Drop GFP_NOFS instances under dquot->dq_lock and dqio_sem	2024-01-23 19:21:11 +01:00
quota.c	fs: Drop wait_unfrozen wait queue	2023-05-30 15:36:40 +02:00
quotaio_v1.h
quotaio_v2.h