In the Linux kernel, the following vulnerability has been resolved:
tmpfs: fix race on handling dquot rbtree
A syzkaller reproducer found a race while attempting to remove dquot information from the rb tree.
Fetching the rbtree root node must also be protected by the dqopt->dqiosem, otherwise, giving the right timing, shmemreleasedquot() will trigger a warning because it couldn't find a node in the tree, when the real reason was the root node changing before the search starts:
Thread 1 Thread 2 - shmemreleasedquot() - shmem{acquire,release}dquot()
fetch ROOT - Fetch ROOT
- acquire dqio_sem
wait dqio_sem
- do something, triger a tree rebalance
- release dqio_sem
acquire dqio_sem