Re: [BUG] quota: NULL function pointer call in dquot_acquire() with QFMT_SHMEM

[Jan Kara]

Hello!

On Thu 27-08-26 15:35:52, Farhad Alemi wrote:
> While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
> SEFCOM lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/103-quota-null-func-ptr-dquot_acquire/
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   #PF: supervisor instruction fetch in kernel mode
>   RIP: 0010:0x0
>   dquot_acquire+0x175/0x610 fs/quota/dquot.c:489
>   dqget+0x795/0xed0 fs/quota/dquot.c:1002
>   __dquot_initialize+0x3ba/0xc60 fs/quota/dquot.c:1530
>   add_dquot_ref+0x2ca/0x3a0 fs/quota/dquot.c:1073
>   dquot_load_quota_sb+0x873/0xb40 fs/quota/dquot.c:2496
>   jfs_quota_on+0x2a/0x110 fs/jfs/super.c:803

Can you send me the reproducer please? I suspect I know what's going on and
it should be obvious from it.

								Honza
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR