CVE-2024-26878

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> quota: Fix potential NULL pointer dereference<br /> <br /> Below race may cause NULL pointer dereference<br /> <br /> P1 P2<br /> dquot_free_inode quota_off<br /> drop_dquot_ref<br /> remove_dquot_ref<br /> dquots = i_dquot(inode)<br /> dquots = i_dquot(inode)<br /> srcu_read_lock<br /> dquots[cnt]) != NULL (1)<br /> dquots[type] = NULL (2)<br /> spin_lock(&amp;dquots[cnt]-&gt;dq_dqb_lock) (3)<br /> ....<br /> <br /> If dquot_free_inode(or other routines) checks inode&amp;#39;s quota pointers (1)<br /> before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer<br /> dereference will be triggered.<br /> <br /> So let&amp;#39;s fix it by using a temporary pointer to avoid this issue.