Description
In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) .... If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered. So let's fix it by using a temporary pointer to avoid this issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac to < 8514899c1a4edf802f03c408db901063aa3f05a1affected7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac to < 49669f8e7eb053f91d239df7b1bfb4500255a9d0affected7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac to < 61380537aa6dd32d8a723d98b8f1bd1b11d8fee0affected7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac to < 1ca72a3de915f87232c9a4cb9bebbd3af8ed3e25affected7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac to < 7f9e833fc0f9b47be503af012eb5903086939754affected7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac to < 40a673b4b07efd6f74ff3ab60f38b26aa91ee5d5affected7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac to < f2649d98aa9ca8623149b3cb8df00c944f5655c7affected7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac to < 6afc9f4434fa8063aa768c2bf5bf98583aee0877affected7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac to < d0aa72604fbd80c8aabb46eda00535ed35570f1faffected
Linux Linux
Default version status: affected
4.14affected0 to < 4.14unaffected4.19.311 to ≤ 4.19.*unaffected5.4.273 to ≤ 5.4.*unaffected5.10.214 to ≤ 5.10.*unaffected5.15.153 to ≤ 5.15.*unaffected6.1.83 to ≤ 6.1.*unaffected6.6.23 to ≤ 6.6.*unaffected6.7.11 to ≤ 6.7.*unaffected6.8.2 to ≤ 6.8.*unaffected6.9 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8514899c1a4edf802f03c408db901063aa3f05a1 ↗
- https://git.kernel.org/stable/c/49669f8e7eb053f91d239df7b1bfb4500255a9d0 ↗
- https://git.kernel.org/stable/c/61380537aa6dd32d8a723d98b8f1bd1b11d8fee0 ↗
- https://git.kernel.org/stable/c/1ca72a3de915f87232c9a4cb9bebbd3af8ed3e25 ↗
- https://git.kernel.org/stable/c/7f9e833fc0f9b47be503af012eb5903086939754 ↗
- https://git.kernel.org/stable/c/40a673b4b07efd6f74ff3ab60f38b26aa91ee5d5 ↗
- https://git.kernel.org/stable/c/f2649d98aa9ca8623149b3cb8df00c944f5655c7 ↗
- https://git.kernel.org/stable/c/6afc9f4434fa8063aa768c2bf5bf98583aee0877 ↗
- https://git.kernel.org/stable/c/d0aa72604fbd80c8aabb46eda00535ed35570f1f ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html ↗