linux-ext4 - Re: [PATCH 1/2] quota: Handle Q_GETNEXTQUOTA when quota is disabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160401143956.GD29897@thunk.org>
Date:	Fri, 1 Apr 2016 10:39:56 -0400
From:	Theodore Ts'o <tytso@....edu>
To:	Jan Kara <jack@...e.cz>
Cc:	linux-ext4@...r.kernel.org, linux-fsdevel@...r.kernel.org,
	ocfs2-devel@....oracle.com
Subject: Re: [PATCH 1/2] quota: Handle Q_GETNEXTQUOTA when quota is disabled

On Tue, Mar 29, 2016 at 06:11:43PM +0200, Jan Kara wrote:
> Currently we oopsed when Q_GETNEXTQUOTA got called when quota was
> disabled. Properly check whether quota is enabled for the filesystem
> before calling into quota format handler.
> 
> diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
> index ba827daea5a0..ff21980d0119 100644
> --- a/fs/quota/dquot.c
> +++ b/fs/quota/dquot.c
> @@ -2047,11 +2047,20 @@ int dquot_get_next_id(struct super_block *sb, struct kqid *qid)
>  	struct quota_info *dqopt = sb_dqopt(sb);
>  	int err;
>  
> -	if (!dqopt->ops[qid->type]->get_next_id)
> -		return -ENOSYS;
> +	mutex_lock(&dqopt->dqonoff_mutex);
> +	if (!sb_has_quota_active(sb, qid->type)) {
> +		err = -ESRCH;
> +		goto out;
> +	}
> +	if (!dqopt->ops[qid->type]->get_next_id) {
> +		err = -ENOSYS;
> +		goto out;
> +	}

Don't you also have to test if dqopt->ops[qid->type] is NULL?  e.g.,
if the quota inode hasn't been loaded for that quota type?

Also, I notice you have this queued on the for_next branch and not the
for_linus branch.  I was hoping you could push this to Linus sooner
than the next merge cycle, since this is (a) making my testing hard,
and (b) it makes it easy for an attacker to crash the system.  For
similar reasons, perhaps this should have a cc: stable@...r.kernel.org
tag?

Thanks,

					- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html