Commit 52f31ed2 authored by Dave Chinner's avatar Dave Chinner Committed by Darrick J. Wong
Browse files

xfs: dquot shrinker doesn't check for XFS_DQFLAG_FREEING 



Resulting in a UAF if the shrinker races with some other dquot
freeing mechanism that sets XFS_DQFLAG_FREEING before the dquot is
removed from the LRU. This can occur if a dquot purge races with
drop_caches.

Reported-by: default avatar <syzbot+912776840162c13db1a3@syzkaller.appspotmail.com>
Signed-off-by: default avatarDave Chinner <dchinner@redhat.com>
Reviewed-by: default avatarDarrick J. Wong <djwong@kernel.org>
Signed-off-by: default avatarDarrick J. Wong <djwong@kernel.org>
parent 1f5619ed

fs/xfs/xfs_qm.c

+12 −4
Original line number Diff line number Diff line
@@ -422,6 +422,14 @@ xfs_qm_dquot_isolate( 
	if (!xfs_dqlock_nowait(dqp))

		goto out_miss_busy;



	/*

	 * If something else is freeing this dquot and hasn't yet removed it

	 * from the LRU, leave it for the freeing task to complete the freeing

	 * process rather than risk it being free from under us here.

	 */

	if (dqp->q_flags & XFS_DQFLAG_FREEING)

		goto out_miss_unlock;



	/*

	 * This dquot has acquired a reference in the meantime remove it from

	 * the freelist and try again.
@@ -441,10 +449,8 @@ xfs_qm_dquot_isolate( 
	 * skip it so there is time for the IO to complete before we try to

	 * reclaim it again on the next LRU pass.

	 */

	if (!xfs_dqflock_nowait(dqp)) {

		xfs_dqunlock(dqp);

		goto out_miss_busy;

	}

	if (!xfs_dqflock_nowait(dqp))

		goto out_miss_unlock;



	if (XFS_DQ_IS_DIRTY(dqp)) {

		struct xfs_buf	*bp = NULL;
@@ -478,6 +484,8 @@ xfs_qm_dquot_isolate( 
	XFS_STATS_INC(dqp->q_mount, xs_qm_dqreclaims);

	return LRU_REMOVED;



out_miss_unlock:

	xfs_dqunlock(dqp);

out_miss_busy:

	trace_xfs_dqreclaim_busy(dqp);

	XFS_STATS_INC(dqp->q_mount, xs_qm_dqreclaim_misses);