gfs2 QuotaData UAF

Vulnerability analysis

The vulnerability stems from incomplete cleanup in the qd_put() function during GFS2 filesystem shutdown. When commit a475c5dd16e5 changed the behavior to free quota data objects synchronously instead of returning them to the LRU list, it failed to remove these objects from the LRU list before freeing them. This creates a dangling pointer situation where freed quota data objects remain linked in the LRU list. Later, when the memory shrinker (gfs2_qd_shrink_scan) runs and attempts to traverse or dispose objects on the LRU list, it accesses freed slab memory, causing a use-after-free condition. Because the object resides on a slab cache, the shrinker's list walks and disposals can read stale or reused memory (information disclosure) and corrupt newly allocated objects (integrity impact) before the invalid access triggers a kernel panic. The fix adds a single line to properly remove quota data objects from the LRU list before freeing them, ensuring list integrity and preventing the UAF.