| commit | c547d9894348375c43931d3631bf7405318230bd | [log] [tgz] |
|---|---|---|
| author | Dave Chinner <dchinner@redhat.com> | Thu Dec 08 09:53:22 2022 -0800 |
| committer | Darrick J. Wong <djwong@kernel.org> | Tue Dec 20 16:45:52 2022 -0800 |
| tree | 718252867d2aa0cde35a0409731e086d52b04572 | |
| parent | aaf610aab052d69cfe37684d9fa7c0b9b2dfd6ce [diff] |
xfs: dquot shrinker doesn't check for XFS_DQFLAG_FREEING Resulting in a UAF if the shrinker races with some other dquot freeing mechanism that sets XFS_DQFLAG_FREEING before the dquot is removed from the LRU. This can occur if a dquot purge races with drop_caches. Reported-by: syzbot+912776840162c13db1a3@syzkaller.appspotmail.com Signed-off-by: Dave Chinner <dchinner@redhat.com> Reviewed-by: Darrick J. Wong <djwong@kernel.org> Signed-off-by: Darrick J. Wong <djwong@kernel.org>