commit f34ab95162763cd7352f46df169296eec28b688d
Author: Baokun Li <libaokun1@huawei.com>
Date:   Fri Aug 5 20:39:47 2022 +0800

    ext4: fix null-ptr-deref in ext4_write_info
    
    commit f9c1f248607d5546075d3f731e7607d5571f2b60 upstream.
    
    I caught a null-ptr-deref bug as follows:
    ==================================================================
    KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]
    CPU: 1 PID: 1589 Comm: umount Not tainted 5.10.0-02219-dirty #339
    RIP: 0010:ext4_write_info+0x53/0x1b0
    [...]
    Call Trace:
     dquot_writeback_dquots+0x341/0x9a0
     ext4_sync_fs+0x19e/0x800
     __sync_filesystem+0x83/0x100
     sync_filesystem+0x89/0xf0
     generic_shutdown_super+0x79/0x3e0
     kill_block_super+0xa1/0x110
     deactivate_locked_super+0xac/0x130
     deactivate_super+0xb6/0xd0
     cleanup_mnt+0x289/0x400
     __cleanup_mnt+0x16/0x20
     task_work_run+0x11c/0x1c0
     exit_to_user_mode_prepare+0x203/0x210
     syscall_exit_to_user_mode+0x5b/0x3a0
     do_syscall_64+0x59/0x70
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
     ==================================================================
    
    Above issue may happen as follows:
    -------------------------------------
    exit_to_user_mode_prepare
     task_work_run
      __cleanup_mnt
       cleanup_mnt
        deactivate_super
         deactivate_locked_super
          kill_block_super
           generic_shutdown_super
            shrink_dcache_for_umount
             dentry = sb->s_root
             sb->s_root = NULL              <--- Here set NULL
            sync_filesystem
             __sync_filesystem
              sb->s_op->sync_fs > ext4_sync_fs
               dquot_writeback_dquots
                sb->dq_op->write_info > ext4_write_info
                 ext4_journal_start(d_inode(sb->s_root), EXT4_HT_QUOTA, 2)
                  d_inode(sb->s_root)
                   s_root->d_inode          <--- Null pointer dereference
    
    To solve this problem, we use ext4_journal_start_sb directly
    to avoid s_root being used.
    
    Cc: stable@kernel.org
    Signed-off-by: Baokun Li <libaokun1@huawei.com>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Link: https://lore.kernel.org/r/20220805123947.565152-1-libaokun1@huawei.com
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index a0af833f7da7..1a12b91bcc6c 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -6273,7 +6273,7 @@ static int ext4_write_info(struct super_block *sb, int type)
        handle_t *handle;
 
        /* Data block + inode block */
-       handle = ext4_journal_start(d_inode(sb->s_root), EXT4_HT_QUOTA, 2);
+       handle = ext4_journal_start_sb(sb, EXT4_HT_QUOTA, 2);
        if (IS_ERR(handle))
                return PTR_ERR(handle);
        ret = dquot_commit_info(sb, type);