[1/2] quota: Handle Q_GETNEXTQUOTA when quota is disabled
diff mbox

Message ID 1459267904-10755-1-git-send-email-jack@suse.cz
State New
Headers show

Commit Message

Jan Kara March 29, 2016, 4:11 p.m. UTC
Currently we oopsed when Q_GETNEXTQUOTA got called when quota was
disabled. Properly check whether quota is enabled for the filesystem
before calling into quota format handler.

Reported-by: Ted Tso <tytso@mit.edu>
Signed-off-by: Jan Kara <jack@suse.cz>
---
 fs/quota/dquot.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

I have queue this fix for the bug Ted reported and will push it to Linus soon.

Comments

Theodore Y. Ts'o April 1, 2016, 2:39 p.m. UTC | #1
On Tue, Mar 29, 2016 at 06:11:43PM +0200, Jan Kara wrote:
> Currently we oopsed when Q_GETNEXTQUOTA got called when quota was
> disabled. Properly check whether quota is enabled for the filesystem
> before calling into quota format handler.
> 
> diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
> index ba827daea5a0..ff21980d0119 100644
> --- a/fs/quota/dquot.c
> +++ b/fs/quota/dquot.c
> @@ -2047,11 +2047,20 @@ int dquot_get_next_id(struct super_block *sb, struct kqid *qid)
>  	struct quota_info *dqopt = sb_dqopt(sb);
>  	int err;
>  
> -	if (!dqopt->ops[qid->type]->get_next_id)
> -		return -ENOSYS;
> +	mutex_lock(&dqopt->dqonoff_mutex);
> +	if (!sb_has_quota_active(sb, qid->type)) {
> +		err = -ESRCH;
> +		goto out;
> +	}
> +	if (!dqopt->ops[qid->type]->get_next_id) {
> +		err = -ENOSYS;
> +		goto out;
> +	}

Don't you also have to test if dqopt->ops[qid->type] is NULL?  e.g.,
if the quota inode hasn't been loaded for that quota type?

Also, I notice you have this queued on the for_next branch and not the
for_linus branch.  I was hoping you could push this to Linus sooner
than the next merge cycle, since this is (a) making my testing hard,
and (b) it makes it easy for an attacker to crash the system.  For
similar reasons, perhaps this should have a cc: stable@vger.kernel.org
tag?

Thanks,

					- Ted
Jan Kara April 4, 2016, 9:40 a.m. UTC | #2
On Fri 01-04-16 10:39:56, Ted Tso wrote:
> On Tue, Mar 29, 2016 at 06:11:43PM +0200, Jan Kara wrote:
> > Currently we oopsed when Q_GETNEXTQUOTA got called when quota was
> > disabled. Properly check whether quota is enabled for the filesystem
> > before calling into quota format handler.
> > 
> > diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
> > index ba827daea5a0..ff21980d0119 100644
> > --- a/fs/quota/dquot.c
> > +++ b/fs/quota/dquot.c
> > @@ -2047,11 +2047,20 @@ int dquot_get_next_id(struct super_block *sb, struct kqid *qid)
> >  	struct quota_info *dqopt = sb_dqopt(sb);
> >  	int err;
> >  
> > -	if (!dqopt->ops[qid->type]->get_next_id)
> > -		return -ENOSYS;
> > +	mutex_lock(&dqopt->dqonoff_mutex);
> > +	if (!sb_has_quota_active(sb, qid->type)) {
> > +		err = -ESRCH;
> > +		goto out;
> > +	}
> > +	if (!dqopt->ops[qid->type]->get_next_id) {
> > +		err = -ENOSYS;
> > +		goto out;
> > +	}
> 
> Don't you also have to test if dqopt->ops[qid->type] is NULL?  e.g.,
> if the quota inode hasn't been loaded for that quota type?

Well, we first setup ->ops[type], then load quota inode, and only after
that enable flags which sb_has_quota_active() is checking so I don't see a
need for additional checking of dqopt->ops[qid->type].

> Also, I notice you have this queued on the for_next branch and not the
> for_linus branch.  I was hoping you could push this to Linus sooner
> than the next merge cycle, since this is (a) making my testing hard,
> and (b) it makes it easy for an attacker to crash the system.  For
> similar reasons, perhaps this should have a cc: stable@vger.kernel.org
> tag?

The problematic code was merged in this merge window so no point to cc
stable. I want to push the fix to Linus for rc3 (likely today or tomorrow)
so you should be able to get that soon. Sorry for complications.

								Honza

Patch
diff mbox

diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index ba827daea5a0..ff21980d0119 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -2047,11 +2047,20 @@  int dquot_get_next_id(struct super_block *sb, struct kqid *qid)
 	struct quota_info *dqopt = sb_dqopt(sb);
 	int err;
 
-	if (!dqopt->ops[qid->type]->get_next_id)
-		return -ENOSYS;
+	mutex_lock(&dqopt->dqonoff_mutex);
+	if (!sb_has_quota_active(sb, qid->type)) {
+		err = -ESRCH;
+		goto out;
+	}
+	if (!dqopt->ops[qid->type]->get_next_id) {
+		err = -ENOSYS;
+		goto out;
+	}
 	mutex_lock(&dqopt->dqio_mutex);
 	err = dqopt->ops[qid->type]->get_next_id(sb, qid);
 	mutex_unlock(&dqopt->dqio_mutex);
+out:
+	mutex_unlock(&dqopt->dqonoff_mutex);
 
 	return err;
 }