Unverified Commit 56325e8c authored by Mateusz Guzik's avatar Mateusz Guzik Committed by Christian Brauner
Browse files

landlock: fix splats from iput() after it started calling might_sleep() 



At this point it is guaranteed this is not the last reference.

However, a recent addition of might_sleep() at top of iput() started
generating false-positives as it was executing for all values.

Remedy the problem by using the newly introduced iput_not_last().

Reported-by: default avatar <syzbot+12479ae15958fc3f54ec@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/all/68d32659.a70a0220.4f78.0012.GAE@google.com/


Fixes: 2ef435a8 ("fs: add might_sleep() annotation to iput() and more")
Signed-off-by: default avatarMateusz Guzik <mjguzik@gmail.com>
Link: https://patch.msgid.link/20251105212025.807549-2-mjguzik@gmail.com


Reviewed-by: default avatarMickaël Salaün <mic@digikod.net>
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent 12741624

security/landlock/fs.c

+3 −4
Original line number Diff line number Diff line
@@ -1335,11 +1335,10 @@ static void hook_sb_delete(struct super_block *const sb) 
			 * At this point, we own the ihold() reference that was

			 * originally set up by get_inode_object() and the

			 * __iget() reference that we just set in this loop

			 * walk.  Therefore the following call to iput() will

			 * not sleep nor drop the inode because there is now at

			 * least two references to it.

			 * walk.  Therefore there are at least two references

			 * on the inode.

			 */

			iput(inode);

			iput_not_last(inode);

		} else {

			spin_unlock(&object->lock);

			rcu_read_unlock();