In the Linux kernel, the following vulnerability has been resolved:

ext4: turn quotas off if mount failed after enabling quotas

Yi found during a review of the patch "ext4: don't BUG on inconsistent journal feature" that when ext4markrecovery_complete() returns an error value, the error handling path does not turn off the enabled quotas, which triggers the following kmemleak:

================================================================ unreferenced object 0xffff8cf68678e7c0 (size 64): comm "mount", pid 746, jiffies 4294871231 (age 11.540s) hex dump (first 32 bytes): 00 90 ef 82 f6 8c ff ff 00 00 00 00 41 01 00 00 ............A... c7 00 00 00 bd 00 00 00 0a 00 00 00 48 00 00 00 ............H... backtrace: [<00000000c561ef24>] __kmemcachealloc_node+0x4d4/0x880 [<00000000d4e621d7>] kmalloctrace+0x39/0x140 [<00000000837eee74>] v2readfileinfo+0x18a/0x3a0 [<0000000088f6c877>] dquotloadquotasb+0x2ed/0x770 [<00000000340a4782>] dquotloadquotainode+0xc6/0x1c0 [<0000000089a18bd5>] ext4enablequotas+0x17e/0x3a0 [ext4] [<000000003a0268fa>] __ext4fillsuper+0x3448/0x3910 [ext4] [<00000000b0f2a8a8>] ext4fillsuper+0x13d/0x340 [ext4] [<000000004a9489c4>] gettreebdev+0x1dc/0x370 [<000000006e723bf1>] ext4gettree+0x1d/0x30 [ext4] [<00000000c7cb663d>] vfsgettree+0x31/0x160 [<00000000320e1bed>] donewmount+0x1d5/0x480 [<00000000c074654c>] pathmount+0x22e/0xbe0 [<0000000003e97a8e>] domount+0x95/0xc0 [<000000002f3d3736>] __x64sysmount+0xc4/0x160

[<0000000027d2140c>] dosyscall64+0x3f/0x90

To solve this problem, we add a "failedmount10" tag, and call ext4quotaoffumount() in this tag to release the enabled qoutas.