[BUG] quota: NULL function pointer call in dquot_acquire() with QFMT_SHMEM

[Farhad Alemi]

Hello Jan,

While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
SEFCOM lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/103-quota-null-func-ptr-dquot_acquire/

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  #PF: supervisor instruction fetch in kernel mode
  RIP: 0010:0x0
  dquot_acquire+0x175/0x610 fs/quota/dquot.c:489
  dqget+0x795/0xed0 fs/quota/dquot.c:1002
  __dquot_initialize+0x3ba/0xc60 fs/quota/dquot.c:1530
  add_dquot_ref+0x2ca/0x3a0 fs/quota/dquot.c:1073
  dquot_load_quota_sb+0x873/0xb40 fs/quota/dquot.c:2496
  jfs_quota_on+0x2a/0x110 fs/jfs/super.c:803

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,