[PATCH 0/2] quota: Verify special quota formats match sb type

[PATCH 0/2] quota: Verify special quota formats match sb type

[Jan Kara]

Hello,

there are certain quota formats that are created only for particular
filesystems - ocfs2 and tmpfs quota formats in particular. Make sure these
formats are indeed being enabled only for filesystem of appropriate type.
Otherwise quota format operations can easily crash as was spotted by fuzz
testing. The only gripe I have with this solution is the recognition of
filesystem type based on sb->s_type->name looks a bit hacky. Another way to do
this would be to directly compare against e.g. shmem_fs_type but that is a bit
cumbersome since struct file_system_type is generally declared in a relatively
narrow scope (not available where quota ops are implemented) so the filesystem
would need to provide a helper to compare against it. Let me know what people
prefer.

Once reviewed, I can merge these patches through my tree as they are only quota
related and very unlikely to clash with anything.

								Honza

[PATCH 1/2] ocfs2: Refuse to enable ocfs2 format for another filesystem

[Jan Kara]

It is possible to issue Q_QUOTAON quotactl(2) e.g. for ext4 filesystem
requesting to enable quota using ocfs2 quota format. With suitable
passed arguments this can get upto ocfs2_local_check_quota_file() where
the passed superblock is from the ext4 filesystem and that can cause all
sorts of interesting things, most likely crashes. As ocfs2 quotas are
specific to ocfs2 filesystem, verify we are indeed enabling quotas
there.

Signed-off-by: Jan Kara <jack@suse.cz>
---
 fs/ocfs2/quota_local.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index f55810c59b1b..97dee8ee6096 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -171,6 +171,10 @@ static int ocfs2_local_check_quota_file(struct super_block *sb, int type)
 	struct ocfs2_disk_dqheader *dqhead;
 	int status, ret = 0;
 
+	/* OCFS2 quota format is supported only for OCFS2 filesystems */
+	if (strcmp(sb->s_type->name, "ocfs2"))
+		goto out_err;
+
 	/* First check whether we understand local quota file */
 	status = ocfs2_read_quota_block(linode, 0, &bh);
 	if (status) {
-- 
2.51.0

Re: [PATCH 1/2] ocfs2: Refuse to enable ocfs2 format for another filesystem

[Mark Fasheh]

On Wed, Sep 2, 2026 at 8:26 AM Jan Kara <jack@suse.cz> wrote:
>
> It is possible to issue Q_QUOTAON quotactl(2) e.g. for ext4 filesystem
> requesting to enable quota using ocfs2 quota format. With suitable
> passed arguments this can get upto ocfs2_local_check_quota_file() where
> the passed superblock is from the ext4 filesystem and that can cause all
> sorts of interesting things, most likely crashes. As ocfs2 quotas are
> specific to ocfs2 filesystem, verify we are indeed enabling quotas
> there.
>
> Signed-off-by: Jan Kara <jack@suse.cz>

Reviewed-by: Mark Fasheh <mark@fasheh.com>

Re: [PATCH 1/2] ocfs2: Refuse to enable ocfs2 format for another filesystem

[Joseph Qi]

On 9/2/26 9:36 PM, Jan Kara wrote:
> It is possible to issue Q_QUOTAON quotactl(2) e.g. for ext4 filesystem
> requesting to enable quota using ocfs2 quota format. With suitable
> passed arguments this can get upto ocfs2_local_check_quota_file() where
> the passed superblock is from the ext4 filesystem and that can cause all
> sorts of interesting things, most likely crashes. As ocfs2 quotas are
> specific to ocfs2 filesystem, verify we are indeed enabling quotas
> there.
> 
> Signed-off-by: Jan Kara <jack@suse.cz>

Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> ---
>  fs/ocfs2/quota_local.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
> index f55810c59b1b..97dee8ee6096 100644
> --- a/fs/ocfs2/quota_local.c
> +++ b/fs/ocfs2/quota_local.c
> @@ -171,6 +171,10 @@ static int ocfs2_local_check_quota_file(struct super_block *sb, int type)
>  	struct ocfs2_disk_dqheader *dqhead;
>  	int status, ret = 0;
>  
> +	/* OCFS2 quota format is supported only for OCFS2 filesystems */
> +	if (strcmp(sb->s_type->name, "ocfs2"))
> +		goto out_err;
> +
>  	/* First check whether we understand local quota file */
>  	status = ocfs2_read_quota_block(linode, 0, &bh);
>  	if (status) {

[PATCH 2/2] shmem: Refuse to enable tmpfs format for another filesystem

[Jan Kara]

It is possible to issue Q_QUOTAON quotactl(2) e.g. for ext4 filesystem
requesting to enable quota using tmpfs quota format. With suitable
passed arguments this can actually succeed in enabling tmpfs quota
format on top of ext4 filesystem which leads to crashes later in
dquot_acquire().  As tmpfs quota format is intended for tmpfs
filesystems only, verify we are indeed enabling quotas there.

Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Signed-off-by: Jan Kara <jack@suse.cz>
---
 mm/shmem_quota.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mm/shmem_quota.c b/mm/shmem_quota.c
index d0b92d6da50f..6e0b43cbded3 100644
--- a/mm/shmem_quota.c
+++ b/mm/shmem_quota.c
@@ -54,6 +54,10 @@ struct quota_id {
 
 static int shmem_check_quota_file(struct super_block *sb, int type)
 {
+	/* Verify enabling happens on tmpfs superblock */
+	if (strcmp(sb->s_type->name, "tmpfs"))
+		return 0;
+
 	/* There is no real quota file, nothing to do */
 	return 1;
 }
-- 
2.51.0

Re: [PATCH 2/2] shmem: Refuse to enable tmpfs format for another filesystem

[Hugh Dickins]

On Wed, 2 Sep 2026, Jan Kara wrote:

> It is possible to issue Q_QUOTAON quotactl(2) e.g. for ext4 filesystem
> requesting to enable quota using tmpfs quota format. With suitable
> passed arguments this can actually succeed in enabling tmpfs quota
> format on top of ext4 filesystem which leads to crashes later in
> dquot_acquire().  As tmpfs quota format is intended for tmpfs
> filesystems only, verify we are indeed enabling quotas there.
> 
> Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
> Signed-off-by: Jan Kara <jack@suse.cz>
> ---
>  mm/shmem_quota.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/mm/shmem_quota.c b/mm/shmem_quota.c
> index d0b92d6da50f..6e0b43cbded3 100644
> --- a/mm/shmem_quota.c
> +++ b/mm/shmem_quota.c
> @@ -54,6 +54,10 @@ struct quota_id {
>  
>  static int shmem_check_quota_file(struct super_block *sb, int type)
>  {
> +	/* Verify enabling happens on tmpfs superblock */
> +	if (strcmp(sb->s_type->name, "tmpfs"))
> +		return 0;
> +

I don't object to this, but was rather expecting you'd check s_magic
for TMPFS_MAGIC: isn't this the kind of hi-tech thing s_magic is for?

Thanks anyway,
Hugh

>  	/* There is no real quota file, nothing to do */
>  	return 1;
>  }
> -- 
> 2.51.0

Re: [PATCH 2/2] shmem: Refuse to enable tmpfs format for another filesystem

[Jan Kara]

On Wed 02-09-26 19:31:39, Hugh Dickins wrote:
> On Wed, 2 Sep 2026, Jan Kara wrote:
> 
> > It is possible to issue Q_QUOTAON quotactl(2) e.g. for ext4 filesystem
> > requesting to enable quota using tmpfs quota format. With suitable
> > passed arguments this can actually succeed in enabling tmpfs quota
> > format on top of ext4 filesystem which leads to crashes later in
> > dquot_acquire().  As tmpfs quota format is intended for tmpfs
> > filesystems only, verify we are indeed enabling quotas there.
> > 
> > Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
> > Signed-off-by: Jan Kara <jack@suse.cz>
> > ---
> >  mm/shmem_quota.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> > 
> > diff --git a/mm/shmem_quota.c b/mm/shmem_quota.c
> > index d0b92d6da50f..6e0b43cbded3 100644
> > --- a/mm/shmem_quota.c
> > +++ b/mm/shmem_quota.c
> > @@ -54,6 +54,10 @@ struct quota_id {
> >  
> >  static int shmem_check_quota_file(struct super_block *sb, int type)
> >  {
> > +	/* Verify enabling happens on tmpfs superblock */
> > +	if (strcmp(sb->s_type->name, "tmpfs"))
> > +		return 0;
> > +
> 
> I don't object to this, but was rather expecting you'd check s_magic
> for TMPFS_MAGIC: isn't this the kind of hi-tech thing s_magic is for?

Oh, I completely forgot about s_magic. Yes, I guess that will be better
than looking at sb->s_type. Thanks for the idea.

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR