Linux Kernel GFS2 File System Use-After-Free Vulnerability in Quota Deallocation

A use-after-free vulnerability has been identified in the Linux kernel's GFS2 file system, specifically within the quota deallocation process. The issue arises in the 'gfs2_qd_dealloc()' function, which is called as a Read-Copy Update (RCU) callback. This function accesses the superblock object after the quota data object has been freed, leading to potential memory corruption. The vulnerability can be triggered when 'gfs2_quota_cleanup()' is called during the unmount process, causing the premature disposal of quota objects while RCU callbacks referencing them are still pending.

Impact

Exploitation of this vulnerability can lead to memory corruption, which may be exploited to execute arbitrary code or cause a denial-of-service condition by crashing the system.

Reproduction

To reproduce this vulnerability, mount a GFS2 file system and enable quota management. Then, unmount the file system while the quota cleanup process is still active. This can be done by manually triggering 'gfs2_quota_cleanup()' before the unmount operation completes, ensuring that RCU callbacks are scheduled to run after the file system has been unmounted.

Remediation

The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version available in the Linux kernel stable tree.