From: Amir Goldstein <amir73il@gmail.com> stable inclusion from stable-v6.6.144 commit ba3ebdd89fa2071639dedd426c933f422a20dec6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15316 CVE: CVE-2026-46054 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit 880bd496ec72a6dcb00cb70c430ef752ba242ae7 ] In preparation to adding LSM blob to backing_file struct, factor out helpers init_backing_file() and backing_file_free(). Cc: stable@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org Cc: linux-unionfs@vger.kernel.org Cc: linux-erofs@lists.ozlabs.org Signed-off-by: Amir Goldstein <amir73il@gmail.com> Reviewed-by: Serge Hallyn <serge@hallyn.com> [PM: use the term "LSM blob", fix comment style to match file] Signed-off-by: Paul Moore <paul@paul-moore.com> [1. The commit def3ae83da02 ("fs: store real path instead of fake path in backing file f_path") is not merged, The 6.6 LTS version accordingly operates on &ff->real_path instead of &ff->user_path. 2. Mainline's file_free() does both the backing_file cleanup and the kmem_cache_free() synchronously. Linux 6.6.y defers the actual kfree() to file_free_rcu() via call_rcu(), so only path_put() is done synchronously in file_free().] Signed-off-by: Cai Xinchen <caixinchen1@huawei.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Conflicts: fs/file_table.c [commit def3ae83da02 ("fs: store real path instead of fake path in backing file f_path") is backport, use user_path instead of real_path] Signed-off-by: Cai Xinchen <caixinchen1@huawei.com> --- fs/file_table.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/fs/file_table.c b/fs/file_table.c index 9af699732a21..760fdc35899d 100644 --- a/fs/file_table.c +++ b/fs/file_table.c @@ -104,11 +104,16 @@ static void file_free_rcu(struct rcu_head *head) kmem_cache_free(filp_cachep, GET_FILE_WRAP(f)); } +static inline void backing_file_free(struct backing_file *ff) +{ + path_put(&ff->user_path); +} + static inline void file_free(struct file *f) { security_file_free(f); if (unlikely(f->f_mode & FMODE_BACKING)) - path_put(backing_file_user_path(f)); + backing_file_free(backing_file(f)); if (likely(!(f->f_mode & FMODE_NOACCOUNT))) percpu_counter_dec(&nr_files); call_rcu(&f->f_u.fu_rcuhead, file_free_rcu); @@ -249,6 +254,12 @@ struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred) return f; } +static int init_backing_file(struct backing_file *ff) +{ + memset(&ff->user_path, 0, sizeof(ff->user_path)); + return 0; +} + /* * Variant of alloc_empty_file() that allocates a backing_file container * and doesn't check and modify nr_files. @@ -271,7 +282,14 @@ struct file *alloc_empty_backing_file(int flags, const struct cred *cred) return ERR_PTR(error); } + /* The f_mode flags must be set before fput(). */ ff->file.f_mode |= FMODE_BACKING | FMODE_NOACCOUNT; + error = init_backing_file(ff); + if (unlikely(error)) { + fput(&ff->file); + return ERR_PTR(error); + } + return &ff->file; } -- 2.18.0.huawei.25