From 3a84fc1a21577dbc8da7e4b6a49c9d8b07c07000 Mon Sep 17 00:00:00 2001 From: Cai Xinchen Date: Tue, 7 Jul 2026 08:06:15 +0000 Subject: [PATCH] lsm: don't call security_backing_file_free() multiple times I found the following path: alloc_empty_backing-file init_file(&ff->file, xxx) -> file_ref_init(&f->f_ref, 1); // only 1 error = init_backing_file -> security_backing_file_alloc -> rc = call_int_hook(backing_file_alloc, ...) if (unlikely(rc)) security_backing_file_free(backing_file); // first call if (unlikely(error)) { fput(&ff->file); -> if (unlikely(file_ref_put(&file->f_ref))) // zero __fput_deferred(file); -> ____fput -> __fput -> file_free(file); -> backing_file_free(backing_file(f)); -> security_backing_file_free(&ff->file); // second call Currently, only SELinux has the lsm backing_file_alloc hook, and it always return 0. When security_backing_file_free is called for the first time, the blobs pointer is set to NULL. Therefore, double free will not occur in the code. Fixes: 6af36aeb147a ("lsm: add backing_file LSM hooks") Signed-off-by: Cai Xinchen [PM: subject line tweaks] Signed-off-by: Paul Moore --- security/security.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/security/security.c b/security/security.c index b284e24e3771..ecfb875f0c69 100644 --- a/security/security.c +++ b/security/security.c @@ -2500,9 +2500,8 @@ void security_backing_file_free(struct file *backing_file) { void *blob = backing_file_security(backing_file); - call_void_hook(backing_file_free, backing_file); - if (blob) { + call_void_hook(backing_file_free, backing_file); backing_file_set_security(backing_file, NULL); kmem_cache_free(lsm_backing_file_cache, blob); }