Re: [PATCH 2/2] shmem: Refuse to enable tmpfs format for another filesystem

[Hugh Dickins <hughd@google.com>]

On Wed, 2 Sep 2026, Jan Kara wrote:

> It is possible to issue Q_QUOTAON quotactl(2) e.g. for ext4 filesystem
> requesting to enable quota using tmpfs quota format. With suitable
> passed arguments this can actually succeed in enabling tmpfs quota
> format on top of ext4 filesystem which leads to crashes later in
> dquot_acquire().  As tmpfs quota format is intended for tmpfs
> filesystems only, verify we are indeed enabling quotas there.
> 
> Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
> Signed-off-by: Jan Kara <jack@suse.cz>
> ---
>  mm/shmem_quota.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/mm/shmem_quota.c b/mm/shmem_quota.c
> index d0b92d6da50f..6e0b43cbded3 100644
> --- a/mm/shmem_quota.c
> +++ b/mm/shmem_quota.c
> @@ -54,6 +54,10 @@ struct quota_id {
>  
>  static int shmem_check_quota_file(struct super_block *sb, int type)
>  {
> +	/* Verify enabling happens on tmpfs superblock */
> +	if (strcmp(sb->s_type->name, "tmpfs"))
> +		return 0;
> +

I don't object to this, but was rather expecting you'd check s_magic
for TMPFS_MAGIC: isn't this the kind of hi-tech thing s_magic is for?

Thanks anyway,
Hugh

>  	/* There is no real quota file, nothing to do */
>  	return 1;
>  }
> -- 
> 2.51.0