ext4: improve error recovery code paths in __ext4_remount()

commit 4c0b4818b1f636bc96359f7817a2d8bab6370162 upstream.

If there are failures while changing the mount options in
__ext4_remount(), we need to restore the old mount options.

This commit fixes two problem.  The first is there is a chance that we
will free the old quota file names before a potential failure leading
to a use-after-free.  The second problem addressed in this commit is
if there is a failed read/write to read-only transition, if the quota
has already been suspended, we need to renable quota handling.

Cc: stable@kernel.org
Link: https://lore.kernel.org/r/20230506142419.984260-2-tytso@mit.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 7ba88d4e53e871d8f9db40d00b59f9d0b6a2be35..45f366408a1f257be8a2228d0474130eee2248de 100644 (file)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5390,9 +5390,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
                ext4_commit_super(sb, 1);
 
 #ifdef CONFIG_QUOTA
-       /* Release old quota file names */
-       for (i = 0; i < EXT4_MAXQUOTAS; i++)
-               kfree(old_opts.s_qf_names[i]);
        if (enable_quota) {
                if (sb_any_quota_suspended(sb))
                        dquot_resume(sb, -1);
@@ -5402,6 +5399,9 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
                                goto restore_opts;
                }
        }
+       /* Release old quota file names */
+       for (i = 0; i < EXT4_MAXQUOTAS; i++)
+               kfree(old_opts.s_qf_names[i]);
 #endif
 
        *flags = (*flags & ~MS_LAZYTIME) | (sb->s_flags & MS_LAZYTIME);
@@ -5410,6 +5410,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
        return 0;
 
 restore_opts:
+       /*
+        * If there was a failing r/w to ro transition, we may need to
+        * re-enable quota
+        */
+       if ((sb->s_flags & SB_RDONLY) && !(old_sb_flags & SB_RDONLY) &&
+           sb_any_quota_suspended(sb))
+               dquot_resume(sb, -1);
        sb->s_flags = old_sb_flags;
        sbi->s_mount_opt = old_opts.s_mount_opt;
        sbi->s_mount_opt2 = old_opts.s_mount_opt2;