Unverified Commit 29916de9 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!6689 quota: Fix potential NULL pointer dereference 

Merge Pull Request from: @ci-robot 
 
PR sync from: Baokun Li <libaokun1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/RHHFK5NKE64LS6XVEOJD2ZOQR6MCMMS6/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9HJX7 
 
Link:https://gitee.com/openeuler/kernel/pulls/6689

 

Reviewed-by: default avatarzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 159a55c8 b6c35c29

fs/quota/dquot.c

+57 −41
Original line number Diff line number Diff line
@@ -399,15 +399,17 @@ int dquot_mark_dquot_dirty(struct dquot *dquot) 
EXPORT_SYMBOL(dquot_mark_dquot_dirty);



/* Dirtify all the dquots - this can block when journalling */

static inline int mark_all_dquot_dirty(struct dquot * const *dquot)

static inline int mark_all_dquot_dirty(struct dquot * const *dquots)

{

	int ret, err, cnt;

	struct dquot *dquot;



	ret = err = 0;

	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {

		if (dquot[cnt])

		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (dquot)

			/* Even in case of error we have to continue */

			ret = mark_dquot_dirty(dquot[cnt]);

			ret = mark_dquot_dirty(dquot);

		if (!err)

			err = ret;

	}
@@ -1674,6 +1676,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) 
	struct dquot_warn warn[MAXQUOTAS];

	int reserve = flags & DQUOT_SPACE_RESERVE;

	struct dquot **dquots;

	struct dquot *dquot;



	if (!inode_quota_active(inode)) {

		if (reserve) {
@@ -1693,27 +1696,26 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) 
	index = srcu_read_lock(&dquot_srcu);

	spin_lock(&inode->i_lock);

	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {

		if (!dquots[cnt])

		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (!dquot)

			continue;

		if (reserve) {

			ret = dquot_add_space(dquots[cnt], 0, number, flags,

					      &warn[cnt]);

			ret = dquot_add_space(dquot, 0, number, flags, &warn[cnt]);

		} else {

			ret = dquot_add_space(dquots[cnt], number, 0, flags,

					      &warn[cnt]);

			ret = dquot_add_space(dquot, number, 0, flags, &warn[cnt]);

		}

		if (ret) {

			/* Back out changes we already did */

			for (cnt--; cnt >= 0; cnt--) {

				if (!dquots[cnt])

				dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

				if (!dquot)

					continue;

				spin_lock(&dquots[cnt]->dq_dqb_lock);

				spin_lock(&dquot->dq_dqb_lock);

				if (reserve)

					dquot_free_reserved_space(dquots[cnt],

								  number);

					dquot_free_reserved_space(dquot, number);

				else

					dquot_decr_space(dquots[cnt], number);

				spin_unlock(&dquots[cnt]->dq_dqb_lock);

					dquot_decr_space(dquot, number);

				spin_unlock(&dquot->dq_dqb_lock);

			}

			spin_unlock(&inode->i_lock);

			goto out_flush_warn;
@@ -1744,6 +1746,7 @@ int dquot_alloc_inode(struct inode *inode) 
	int cnt, ret = 0, index;

	struct dquot_warn warn[MAXQUOTAS];

	struct dquot * const *dquots;

	struct dquot *dquot;



	if (!inode_quota_active(inode))

		return 0;
@@ -1754,17 +1757,19 @@ int dquot_alloc_inode(struct inode *inode) 
	index = srcu_read_lock(&dquot_srcu);

	spin_lock(&inode->i_lock);

	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {

		if (!dquots[cnt])

		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (!dquot)

			continue;

		ret = dquot_add_inodes(dquots[cnt], 1, &warn[cnt]);

		ret = dquot_add_inodes(dquot, 1, &warn[cnt]);

		if (ret) {

			for (cnt--; cnt >= 0; cnt--) {

				if (!dquots[cnt])

				dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

				if (!dquot)

					continue;

				/* Back out changes we already did */

				spin_lock(&dquots[cnt]->dq_dqb_lock);

				dquot_decr_inodes(dquots[cnt], 1);

				spin_unlock(&dquots[cnt]->dq_dqb_lock);

				spin_lock(&dquot->dq_dqb_lock);

				dquot_decr_inodes(dquot, 1);

				spin_unlock(&dquot->dq_dqb_lock);

			}

			goto warn_put_all;

		}
@@ -1786,6 +1791,7 @@ EXPORT_SYMBOL(dquot_alloc_inode); 
int dquot_claim_space_nodirty(struct inode *inode, qsize_t number)

{

	struct dquot **dquots;

	struct dquot *dquot;

	int cnt, index;



	if (!inode_quota_active(inode)) {
@@ -1801,9 +1807,8 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) 
	spin_lock(&inode->i_lock);

	/* Claim reserved quotas to allocated quotas */

	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {

		if (dquots[cnt]) {

			struct dquot *dquot = dquots[cnt];



		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (dquot) {

			spin_lock(&dquot->dq_dqb_lock);

			if (WARN_ON_ONCE(dquot->dq_dqb.dqb_rsvspace < number))

				number = dquot->dq_dqb.dqb_rsvspace;
@@ -1828,6 +1833,7 @@ EXPORT_SYMBOL(dquot_claim_space_nodirty); 
void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number)

{

	struct dquot **dquots;

	struct dquot *dquot;

	int cnt, index;



	if (!inode_quota_active(inode)) {
@@ -1843,9 +1849,8 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) 
	spin_lock(&inode->i_lock);

	/* Claim reserved quotas to allocated quotas */

	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {

		if (dquots[cnt]) {

			struct dquot *dquot = dquots[cnt];



		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (dquot) {

			spin_lock(&dquot->dq_dqb_lock);

			if (WARN_ON_ONCE(dquot->dq_dqb.dqb_curspace < number))

				number = dquot->dq_dqb.dqb_curspace;
@@ -1872,6 +1877,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) 
	unsigned int cnt;

	struct dquot_warn warn[MAXQUOTAS];

	struct dquot **dquots;

	struct dquot *dquot;

	int reserve = flags & DQUOT_SPACE_RESERVE, index;



	if (!inode_quota_active(inode)) {
@@ -1892,17 +1898,18 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) 
		int wtype;



		warn[cnt].w_type = QUOTA_NL_NOWARN;

		if (!dquots[cnt])

		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (!dquot)

			continue;

		spin_lock(&dquots[cnt]->dq_dqb_lock);

		wtype = info_bdq_free(dquots[cnt], number);

		spin_lock(&dquot->dq_dqb_lock);

		wtype = info_bdq_free(dquot, number);

		if (wtype != QUOTA_NL_NOWARN)

			prepare_warning(&warn[cnt], dquots[cnt], wtype);

			prepare_warning(&warn[cnt], dquot, wtype);

		if (reserve)

			dquot_free_reserved_space(dquots[cnt], number);

			dquot_free_reserved_space(dquot, number);

		else

			dquot_decr_space(dquots[cnt], number);

		spin_unlock(&dquots[cnt]->dq_dqb_lock);

			dquot_decr_space(dquot, number);

		spin_unlock(&dquot->dq_dqb_lock);

	}

	if (reserve)

		*inode_reserved_space(inode) -= number;
@@ -1927,6 +1934,7 @@ void dquot_free_inode(struct inode *inode) 
	unsigned int cnt;

	struct dquot_warn warn[MAXQUOTAS];

	struct dquot * const *dquots;

	struct dquot *dquot;

	int index;



	if (!inode_quota_active(inode))
@@ -1937,16 +1945,16 @@ void dquot_free_inode(struct inode *inode) 
	spin_lock(&inode->i_lock);

	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {

		int wtype;



		warn[cnt].w_type = QUOTA_NL_NOWARN;

		if (!dquots[cnt])

		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (!dquot)

			continue;

		spin_lock(&dquots[cnt]->dq_dqb_lock);

		wtype = info_idq_free(dquots[cnt], 1);

		spin_lock(&dquot->dq_dqb_lock);

		wtype = info_idq_free(dquot, 1);

		if (wtype != QUOTA_NL_NOWARN)

			prepare_warning(&warn[cnt], dquots[cnt], wtype);

		dquot_decr_inodes(dquots[cnt], 1);

		spin_unlock(&dquots[cnt]->dq_dqb_lock);

			prepare_warning(&warn[cnt], dquot, wtype);

		dquot_decr_inodes(dquot, 1);

		spin_unlock(&dquot->dq_dqb_lock);

	}

	spin_unlock(&inode->i_lock);

	mark_all_dquot_dirty(dquots);
@@ -1973,7 +1981,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) 
	qsize_t rsv_space = 0;

	qsize_t inode_usage = 1;

	struct dquot *transfer_from[MAXQUOTAS] = {};

	int cnt, ret = 0;

	int cnt, index, ret = 0;

	char is_valid[MAXQUOTAS] = {};

	struct dquot_warn warn_to[MAXQUOTAS];

	struct dquot_warn warn_from_inodes[MAXQUOTAS];
@@ -2062,8 +2070,16 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) 
	spin_unlock(&inode->i_lock);

	spin_unlock(&dq_data_lock);



	/*

	 * These arrays are local and we hold dquot references so we don't need

	 * the srcu protection but still take dquot_srcu to avoid warning in

	 * mark_all_dquot_dirty().

	 */

	index = srcu_read_lock(&dquot_srcu);

	mark_all_dquot_dirty(transfer_from);

	mark_all_dquot_dirty(transfer_to);

	srcu_read_unlock(&dquot_srcu, index);



	flush_warnings(warn_to);

	flush_warnings(warn_from_inodes);

	flush_warnings(warn_from_space);