Unverified Commit 48d72040 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!6705 quota: fix CVE-2024-26878 

Merge Pull Request from: @ci-robot 
 
PR sync from: Baokun Li <libaokun1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/NE3QLMEVIASWHPKVSVJHJS4QZM5AQCDW/ 
Chengguang Xu (2):
  quota: code cleanup for __dquot_alloc_space()
  quota: check time limit when back out space/inode change

Wang Jianjian (1):
  quota: Fix potential NULL pointer dereference


-- 
2.31.1
 
https://gitee.com/src-openeuler/kernel/issues/I9HJX7 
 
Link:https://gitee.com/openeuler/kernel/pulls/6705

 

Reviewed-by: default avatarzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 6c4027e2 037d1ad6

fs/quota/dquot.c

+60 −46
Original line number Diff line number Diff line
@@ -399,15 +399,17 @@ int dquot_mark_dquot_dirty(struct dquot *dquot) 
EXPORT_SYMBOL(dquot_mark_dquot_dirty);



/* Dirtify all the dquots - this can block when journalling */

static inline int mark_all_dquot_dirty(struct dquot * const *dquot)

static inline int mark_all_dquot_dirty(struct dquot * const *dquots)

{

	int ret, err, cnt;

	struct dquot *dquot;



	ret = err = 0;

	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {

		if (dquot[cnt])

		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (dquot)

			/* Even in case of error we have to continue */

			ret = mark_dquot_dirty(dquot[cnt]);

			ret = mark_dquot_dirty(dquot);

		if (!err)

			err = ret;

	}
@@ -1671,6 +1673,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) 
	struct dquot_warn warn[MAXQUOTAS];

	int reserve = flags & DQUOT_SPACE_RESERVE;

	struct dquot **dquots;

	struct dquot *dquot;



	if (!inode_quota_active(inode)) {

		if (reserve) {
@@ -1690,29 +1693,26 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags) 
	index = srcu_read_lock(&dquot_srcu);

	spin_lock(&inode->i_lock);

	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {

		if (!dquots[cnt])

		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (!dquot)

			continue;

		if (flags & DQUOT_SPACE_RESERVE) {

			ret = dquot_add_space(dquots[cnt], 0, number, flags,

					      &warn[cnt]);

		if (reserve) {

			ret = dquot_add_space(dquot, 0, number, flags, &warn[cnt]);

		} else {

			ret = dquot_add_space(dquots[cnt], number, 0, flags,

					      &warn[cnt]);

			ret = dquot_add_space(dquot, number, 0, flags, &warn[cnt]);

		}

		if (ret) {

			/* Back out changes we already did */

			for (cnt--; cnt >= 0; cnt--) {

				if (!dquots[cnt])

				dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

				if (!dquot)

					continue;

				spin_lock(&dquots[cnt]->dq_dqb_lock);

				if (flags & DQUOT_SPACE_RESERVE) {

					dquots[cnt]->dq_dqb.dqb_rsvspace -=

									number;

				} else {

					dquots[cnt]->dq_dqb.dqb_curspace -=

									number;

				}

				spin_unlock(&dquots[cnt]->dq_dqb_lock);

				spin_lock(&dquot->dq_dqb_lock);

				if (reserve)

					dquot_free_reserved_space(dquot, number);

				else

					dquot_decr_space(dquot, number);

				spin_unlock(&dquot->dq_dqb_lock);

			}

			spin_unlock(&inode->i_lock);

			goto out_flush_warn;
@@ -1743,6 +1743,7 @@ int dquot_alloc_inode(struct inode *inode) 
	int cnt, ret = 0, index;

	struct dquot_warn warn[MAXQUOTAS];

	struct dquot * const *dquots;

	struct dquot *dquot;



	if (!inode_quota_active(inode))

		return 0;
@@ -1753,17 +1754,19 @@ int dquot_alloc_inode(struct inode *inode) 
	index = srcu_read_lock(&dquot_srcu);

	spin_lock(&inode->i_lock);

	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {

		if (!dquots[cnt])

		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (!dquot)

			continue;

		ret = dquot_add_inodes(dquots[cnt], 1, &warn[cnt]);

		ret = dquot_add_inodes(dquot, 1, &warn[cnt]);

		if (ret) {

			for (cnt--; cnt >= 0; cnt--) {

				if (!dquots[cnt])

				dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

				if (!dquot)

					continue;

				/* Back out changes we already did */

				spin_lock(&dquots[cnt]->dq_dqb_lock);

				dquots[cnt]->dq_dqb.dqb_curinodes--;

				spin_unlock(&dquots[cnt]->dq_dqb_lock);

				spin_lock(&dquot->dq_dqb_lock);

				dquot_decr_inodes(dquot, 1);

				spin_unlock(&dquot->dq_dqb_lock);

			}

			goto warn_put_all;

		}
@@ -1785,6 +1788,7 @@ EXPORT_SYMBOL(dquot_alloc_inode); 
int dquot_claim_space_nodirty(struct inode *inode, qsize_t number)

{

	struct dquot **dquots;

	struct dquot *dquot;

	int cnt, index;



	if (!inode_quota_active(inode)) {
@@ -1800,9 +1804,8 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number) 
	spin_lock(&inode->i_lock);

	/* Claim reserved quotas to allocated quotas */

	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {

		if (dquots[cnt]) {

			struct dquot *dquot = dquots[cnt];



		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (dquot) {

			spin_lock(&dquot->dq_dqb_lock);

			if (WARN_ON_ONCE(dquot->dq_dqb.dqb_rsvspace < number))

				number = dquot->dq_dqb.dqb_rsvspace;
@@ -1827,6 +1830,7 @@ EXPORT_SYMBOL(dquot_claim_space_nodirty); 
void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number)

{

	struct dquot **dquots;

	struct dquot *dquot;

	int cnt, index;



	if (!inode_quota_active(inode)) {
@@ -1842,9 +1846,8 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number) 
	spin_lock(&inode->i_lock);

	/* Claim reserved quotas to allocated quotas */

	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {

		if (dquots[cnt]) {

			struct dquot *dquot = dquots[cnt];



		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (dquot) {

			spin_lock(&dquot->dq_dqb_lock);

			if (WARN_ON_ONCE(dquot->dq_dqb.dqb_curspace < number))

				number = dquot->dq_dqb.dqb_curspace;
@@ -1871,6 +1874,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) 
	unsigned int cnt;

	struct dquot_warn warn[MAXQUOTAS];

	struct dquot **dquots;

	struct dquot *dquot;

	int reserve = flags & DQUOT_SPACE_RESERVE, index;



	if (!inode_quota_active(inode)) {
@@ -1891,17 +1895,18 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags) 
		int wtype;



		warn[cnt].w_type = QUOTA_NL_NOWARN;

		if (!dquots[cnt])

		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (!dquot)

			continue;

		spin_lock(&dquots[cnt]->dq_dqb_lock);

		wtype = info_bdq_free(dquots[cnt], number);

		spin_lock(&dquot->dq_dqb_lock);

		wtype = info_bdq_free(dquot, number);

		if (wtype != QUOTA_NL_NOWARN)

			prepare_warning(&warn[cnt], dquots[cnt], wtype);

			prepare_warning(&warn[cnt], dquot, wtype);

		if (reserve)

			dquot_free_reserved_space(dquots[cnt], number);

			dquot_free_reserved_space(dquot, number);

		else

			dquot_decr_space(dquots[cnt], number);

		spin_unlock(&dquots[cnt]->dq_dqb_lock);

			dquot_decr_space(dquot, number);

		spin_unlock(&dquot->dq_dqb_lock);

	}

	if (reserve)

		*inode_reserved_space(inode) -= number;
@@ -1926,6 +1931,7 @@ void dquot_free_inode(struct inode *inode) 
	unsigned int cnt;

	struct dquot_warn warn[MAXQUOTAS];

	struct dquot * const *dquots;

	struct dquot *dquot;

	int index;



	if (!inode_quota_active(inode))
@@ -1936,16 +1942,16 @@ void dquot_free_inode(struct inode *inode) 
	spin_lock(&inode->i_lock);

	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {

		int wtype;



		warn[cnt].w_type = QUOTA_NL_NOWARN;

		if (!dquots[cnt])

		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);

		if (!dquot)

			continue;

		spin_lock(&dquots[cnt]->dq_dqb_lock);

		wtype = info_idq_free(dquots[cnt], 1);

		spin_lock(&dquot->dq_dqb_lock);

		wtype = info_idq_free(dquot, 1);

		if (wtype != QUOTA_NL_NOWARN)

			prepare_warning(&warn[cnt], dquots[cnt], wtype);

		dquot_decr_inodes(dquots[cnt], 1);

		spin_unlock(&dquots[cnt]->dq_dqb_lock);

			prepare_warning(&warn[cnt], dquot, wtype);

		dquot_decr_inodes(dquot, 1);

		spin_unlock(&dquot->dq_dqb_lock);

	}

	spin_unlock(&inode->i_lock);

	mark_all_dquot_dirty(dquots);
@@ -1972,7 +1978,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) 
	qsize_t rsv_space = 0;

	qsize_t inode_usage = 1;

	struct dquot *transfer_from[MAXQUOTAS] = {};

	int cnt, ret = 0;

	int cnt, index, ret = 0;

	char is_valid[MAXQUOTAS] = {};

	struct dquot_warn warn_to[MAXQUOTAS];

	struct dquot_warn warn_from_inodes[MAXQUOTAS];
@@ -2061,8 +2067,16 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to) 
	spin_unlock(&inode->i_lock);

	spin_unlock(&dq_data_lock);



	/*

	 * These arrays are local and we hold dquot references so we don't need

	 * the srcu protection but still take dquot_srcu to avoid warning in

	 * mark_all_dquot_dirty().

	 */

	index = srcu_read_lock(&dquot_srcu);

	mark_all_dquot_dirty(transfer_from);

	mark_all_dquot_dirty(transfer_to);

	srcu_read_unlock(&dquot_srcu, index);



	flush_warnings(warn_to);

	flush_warnings(warn_from_inodes);

	flush_warnings(warn_from_space);