tree 718252867d2aa0cde35a0409731e086d52b04572
parent aaf610aab052d69cfe37684d9fa7c0b9b2dfd6ce
author Dave Chinner <dchinner@redhat.com> 1670522002 -0800
committer Darrick J. Wong <djwong@kernel.org> 1671583552 -0800

xfs: dquot shrinker doesn't check for XFS_DQFLAG_FREEING

Resulting in a UAF if the shrinker races with some other dquot
freeing mechanism that sets XFS_DQFLAG_FREEING before the dquot is
removed from the LRU. This can occur if a dquot purge races with
drop_caches.

Reported-by: syzbot+912776840162c13db1a3@syzkaller.appspotmail.com
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Darrick J. Wong <djwong@kernel.org>