xfs: dquot shrinker doesn't check for XFS_DQFLAG_FREEING

Resulting in a UAF if the shrinker races with some other dquot
freeing mechanism that sets XFS_DQFLAG_FREEING before the dquot is
removed from the LRU. This can occur if a dquot purge races with
drop_caches.

Reported-by: syzbot+912776840162c13db1a3@syzkaller.appspotmail.com
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Darrick J. Wong <djwong@kernel.org>

diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index 18bb4ec..ff53d40 100644 (file)
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -423,6 +423,14 @@ xfs_qm_dquot_isolate(
                goto out_miss_busy;
 
        /*
+        * If something else is freeing this dquot and hasn't yet removed it
+        * from the LRU, leave it for the freeing task to complete the freeing
+        * process rather than risk it being free from under us here.
+        */
+       if (dqp->q_flags & XFS_DQFLAG_FREEING)
+               goto out_miss_unlock;
+
+       /*
         * This dquot has acquired a reference in the meantime remove it from
         * the freelist and try again.
         */
@@ -441,10 +449,8 @@ xfs_qm_dquot_isolate(
         * skip it so there is time for the IO to complete before we try to
         * reclaim it again on the next LRU pass.
         */
-       if (!xfs_dqflock_nowait(dqp)) {
-               xfs_dqunlock(dqp);
-               goto out_miss_busy;
-       }
+       if (!xfs_dqflock_nowait(dqp))
+               goto out_miss_unlock;
 
        if (XFS_DQ_IS_DIRTY(dqp)) {
                struct xfs_buf  *bp = NULL;
@@ -478,6 +484,8 @@ xfs_qm_dquot_isolate(
        XFS_STATS_INC(dqp->q_mount, xs_qm_dqreclaims);
        return LRU_REMOVED;
 
+out_miss_unlock:
+       xfs_dqunlock(dqp);
 out_miss_busy:
        trace_xfs_dqreclaim_busy(dqp);
        XFS_STATS_INC(dqp->q_mount, xs_qm_dqreclaim_misses);