[PATCH v2 2/2] shmem: Refuse to enable tmpfs format for another filesystem

[Jan Kara <jack@suse.cz>]

It is possible to issue Q_QUOTAON quotactl(2) e.g. for ext4 filesystem
requesting to enable quota using tmpfs quota format. With suitable
passed arguments this can actually succeed in enabling tmpfs quota
format on top of ext4 filesystem which leads to crashes later in
dquot_acquire().  As tmpfs quota format is intended for tmpfs
filesystems only, verify we are indeed enabling quotas there.

Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Signed-off-by: Jan Kara <jack@suse.cz>
---
 mm/shmem_quota.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/mm/shmem_quota.c b/mm/shmem_quota.c
index d0b92d6da50f..a3fa4bd93e75 100644
--- a/mm/shmem_quota.c
+++ b/mm/shmem_quota.c
@@ -30,6 +30,7 @@
 #include <linux/slab.h>
 #include <linux/rbtree.h>
 #include <linux/shmem_fs.h>
+#include <linux/magic.h>
 
 #include <linux/quotaops.h>
 #include <linux/quota.h>
@@ -54,6 +55,10 @@ struct quota_id {
 
 static int shmem_check_quota_file(struct super_block *sb, int type)
 {
+	/* Verify enabling happens on tmpfs superblock */
+	if (sb->s_magic != TMPFS_MAGIC)
+		return 0;
+
 	/* There is no real quota file, nothing to do */
 	return 1;
 }
-- 
2.51.0