raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

landlock: fix splats from iput() after it started calling might_sleep()

Browse Source 
At this point it is guaranteed this is not the last reference.

However, a recent addition of might_sleep() at top of iput() started
generating false-positives as it was executing for all values.

Remedy the problem by using the newly introduced iput_not_last().

Reported-by: syzbot+12479ae15958fc3f54ec@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68d32659.a70a0220.4f78.0012.GAE@google.com/
Fixes: 2ef435a872 ("fs: add might_sleep() annotation to iput() and more")
Signed-off-by: Mateusz Guzik <mjguzik@gmail.com>
Link: https://patch.msgid.link/20251105212025.807549-2-mjguzik@gmail.com
Reviewed-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
Mateusz Guzik
2025-11-05 22:20:25 +01:00
committed by Christian Brauner
parent 1274162464
commit 56325e8c68
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
security/landlock/fs.c
View File

@@ -1335,11 +1335,10 @@ static void hook_sb_delete(struct super_block *const sb)
* At this point, we own the ihold() reference that was * At this point, we own the ihold() reference that was
* originally set up by get_inode_object() and the * originally set up by get_inode_object() and the
* __iget() reference that we just set in this loop * __iget() reference that we just set in this loop
* walk. Therefore the following call to iput() will * walk. Therefore there are at least two references
* not sleep nor drop the inode because there is now at * on the inode.
* least two references to it.
*/ */
iput(inode); iput_not_last(inode);
} else { } else {
spin_unlock(&object->lock); spin_unlock(&object->lock);
rcu_read_unlock(); rcu_read_unlock();