xfs: don't crash on corrupt /quotas dirent

If the /quotas dirent points to an inode but the inode isn't loadable
(and hence mkdir returns -EEXIST), don't crash, just bail out.

Cc: <stable@vger.kernel.org> # v6.13-rc1
Fixes: e80fbe1ad8eff7 ("xfs: use metadir for quota inodes")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>

diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index 69b70c3e999d7241e8db5b2b4466fc2695ea498e..dc8b1010d4d332fe219070caa6de89f50418d575 100644 (file)
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -731,6 +731,13 @@ xfs_qm_create_metadir_qinos(
                error = xfs_dqinode_mkdir_parent(mp, &qi->qi_dirip);
                if (error && error != -EEXIST)
                        return error;
+               /*
+                * If the /quotas dirent points to an inode that isn't
+                * loadable, qi_dirip will be NULL but mkdir_parent will return
+                * -EEXIST.  In this case the metadir is corrupt, so bail out.
+                */
+               if (XFS_IS_CORRUPT(mp, qi->qi_dirip == NULL))
+                       return -EFSCORRUPTED;
        }
 
        if (XFS_IS_UQUOTA_ON(mp) && !qi->qi_uquotaip) {