diff options
| author | Mateusz Guzik <mjguzik@gmail.com> | 2025-11-05 22:20:25 +0100 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2025-11-12 10:47:42 +0100 |
| commit | 56325e8c68c0724d626f665773a5005dcf44e329 (patch) | |
| tree | e1b5635e0fd61069b505895f1dd2fa4414a93ba5 /security | |
| parent | 12741624645e098b2234a5ae341045a97473caf1 (diff) | |
landlock: fix splats from iput() after it started calling might_sleep()
At this point it is guaranteed this is not the last reference.
However, a recent addition of might_sleep() at top of iput() started
generating false-positives as it was executing for all values.
Remedy the problem by using the newly introduced iput_not_last().
Reported-by: syzbot+12479ae15958fc3f54ec@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68d32659.a70a0220.4f78.0012.GAE@google.com/
Fixes: 2ef435a872ab ("fs: add might_sleep() annotation to iput() and more")
Signed-off-by: Mateusz Guzik <mjguzik@gmail.com>
Link: https://patch.msgid.link/20251105212025.807549-2-mjguzik@gmail.com
Reviewed-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/landlock/fs.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/security/landlock/fs.c b/security/landlock/fs.c index 0bade2c5aa1d..d9c12b993fa7 100644 --- a/security/landlock/fs.c +++ b/security/landlock/fs.c @@ -1335,11 +1335,10 @@ static void hook_sb_delete(struct super_block *const sb) * At this point, we own the ihold() reference that was * originally set up by get_inode_object() and the * __iget() reference that we just set in this loop - * walk. Therefore the following call to iput() will - * not sleep nor drop the inode because there is now at - * least two references to it. + * walk. Therefore there are at least two references + * on the inode. */ - iput(inode); + iput_not_last(inode); } else { spin_unlock(&object->lock); rcu_read_unlock(); |