diff options
| author | Wang Jianjian <wangjianjian3@huawei.com> | 2024-02-02 11:18:52 +0300 |
|---|---|---|
| committer | Jan Kara <jack@suse.cz> | 2024-02-05 17:57:34 +0300 |
| commit | d0aa72604fbd80c8aabb46eda00535ed35570f1f (patch) | |
| tree | 8cccd6c0659e4113f3b21dc4f3900ee4b5d85a1e /drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | |
| parent | a1e1b2becab7c0b23f18b7999a3b48f76210d3a6 (diff) | |
| download | linux-d0aa72604fbd80c8aabb46eda00535ed35570f1f.tar.xz | |
quota: Fix potential NULL pointer dereference
Below race may cause NULL pointer dereference
P1 P2
dquot_free_inode quota_off
drop_dquot_ref
remove_dquot_ref
dquots = i_dquot(inode)
dquots = i_dquot(inode)
srcu_read_lock
dquots[cnt]) != NULL (1)
dquots[type] = NULL (2)
spin_lock(&dquots[cnt]->dq_dqb_lock) (3)
....
If dquot_free_inode(or other routines) checks inode's quota pointers (1)
before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer
dereference will be triggered.
So let's fix it by using a temporary pointer to avoid this issue.
Signed-off-by: Wang Jianjian <wangjianjian3@huawei.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20240202081852.2514092-1-wangjianjian3@huawei.com>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_object.c')
0 files changed, 0 insertions, 0 deletions