Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:  quota: Fix race of dquot_scan_active() with quota deactivation  dquot_scan_active() can race with quota deactivation in quota_release_workfn() like:    CPU0 (quota_release_workfn)         CPU1 (dquot_scan_active)   ==============================      ==============================   spin_lock(&dq_list_lock);   list_replace_init(     &releasing_dquots, &rls_head);     /* dquot X on rls_head,        dq_count == 0,        DQ_ACTIVE_B still set */   spin_unlock(&dq_list_lock);   synchronize_srcu(&dquot_srcu);                                       spin_lock(&dq_list_lock);                                       list_for_each_entry(dquot,                                           &inuse_list, dq_inuse) {                                         /* finds dquot X */                                         dquot_active(X) -> true                                         atomic_inc(&X->dq_count);                                       }                                       spin_unlock(&dq_list_lock);   spin_lock(&dq_list_lock);   dquot = list_first_entry(&rls_head);   WARN_ON_ONCE(atomic_read(&dquot->dq_count));  The problem is not only a cosmetic one as under memory pressure the caller of dquot_scan_active() can end up working on freed dquot.  Fix the problem by making sure the dquot is removed from releasing list when we acquire a reference to it.