In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix race between quota enable and quota rescan ioctl
When enabling quotas, at btrfsquotaenable(), after committing the transaction, we change fsinfo->quotaroot to point to the quota root we created and set BTRFSFSQUOTAENABLED at fsinfo->flags. Then we try to start the qgroup rescan worker, first by initializing it with a call to qgrouprescaninit() - however if that fails we end up freeing the quota root but we leave fsinfo->quotaroot still pointing to it, this can later result in a use-after-free somewhere else.
We have previously set the flags BTRFSFSQUOTAENABLED and BTRFSQGROUPSTATUSFLAGON, so we can only fail with -EINPROGRESS at btrfsquota_enable(), which is possible if someone already called the quota rescan ioctl, and therefore started the rescan worker.
So fix this by ignoring an -EINPROGRESS and asserting we can't get any other error.