Re: [PATCH] gfs2: fix null-ptr-deref in gfs2_quota_hold during unmount

[Andreas Gruenbacher]

On Tue, Jun 30, 2026 at 6:14 AM Deepanshu Kartikey
<kartikey406@xxxxxxxxx> wrote:
> gfs2_quota_cleanup() frees sd_quota_bitmap early in gfs2_put_super()
> before the iput() calls that can trigger inode eviction. When an unlinked
> inode is evicted during unmount, it goes through:
>
>   gfs2_evict_inode() -> gfs2_dinode_dealloc() -> gfs2_quota_hold()
>     -> qdsb_get() -> slot_get() -> find_first_zero_bit(sd_quota_bitmap)
>
> If sd_quota_bitmap has already been freed by gfs2_quota_cleanup(), this
> results in a null pointer dereference:
>
>   KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
>   _find_first_zero_bit+0x29/0xb0 lib/find_bit.c:149
>   slot_get fs/gfs2/quota.c:355
>   qdsb_get+0x133/0x340 fs/gfs2/quota.c:522
>   gfs2_quota_hold+0x191/0x5c0 fs/gfs2/quota.c:606
>   gfs2_dinode_dealloc+0x176/0x3f0 fs/gfs2/inode.c:488
>   gfs2_evict_inode+0x11cd/0x1400 fs/gfs2/super.c:1479
>   gfs2_put_super+0x300/0x860 fs/gfs2/super.c:618

This is happening when the metadata part of a gfs2 filesystem is
mounted (mount -o meta), the statfs inode is unlinked, and the
metadata filesystem is unmounted. This is not a useful operation; it
will leave an inconsistent filesystem. The kernel should nevertheless
cope with it.

An appropriate fix would be to skip metadata inodes in the quota code.
I will post a patch.

Thanks,
Andreas