Linux Kernel Quota Management Race Condition Vulnerability

A race condition vulnerability has been identified in the Linux kernel's quota management system. This issue arises during the filesystem freeze process, where the quota release workqueue is not properly flushed. As a result, a race condition occurs: dquot entries are added to the releasing list during normal operations, but when the filesystem is frozen, the pending workqueue is not cleared. Once the freeze is complete, the kernel attempts to flush the workqueue, leading to a warning and causing certain tests to fail. This vulnerability was observed on a PowerPC machine with 15 cores.

Impact

Exploitation of this vulnerability causes a race condition that can lead to kernel warnings and test failures, disrupting normal system operations.

Reproduction

The vulnerability can be reproduced by initiating a filesystem freeze, which does not flush the quota release workqueue. After the freeze completes, the kernel will attempt to flush the workqueue while the filesystem is still frozen, triggering a warning that the transaction cannot be started in a frozen state. This sequence of events can be automated with a test that freezes the filesystem and then performs operations that trigger the quota writeback process.

Remediation

To address this vulnerability, ensure that the quota release workqueue is flushed during the quota writeback process, particularly before freezing the filesystem.