[PATCH 2/2] landlock: fix splats from iput() after it started calling might_sleep()

[Mickaël Salaün]

On Wed, Nov 05, 2025 at 10:20:25PM +0100, Mateusz Guzik wrote:
> At this point it is guaranteed this is not the last reference.
> 
> However, a recent addition of might_sleep() at top of iput() started
> generating false-positives as it was executing for all values.
> 
> Remedy the problem by using the newly introduced iput_not_last().
> 
> Reported-by: syzbot+12479ae15958fc3f54ec at syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68d32659.a70a0220.4f78.0012.GAE@google.com/
> Fixes: 2ef435a872ab ("fs: add might_sleep() annotation to iput() and more")
> Signed-off-by: Mateusz Guzik <mjguzik at gmail.com>

Reviewed-by: Mickaël Salaün <mic at digikod.net>

Thanks!

> ---
>  security/landlock/fs.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/security/landlock/fs.c b/security/landlock/fs.c
> index 0bade2c5aa1d..d9c12b993fa7 100644
> --- a/security/landlock/fs.c
> +++ b/security/landlock/fs.c
> @@ -1335,11 +1335,10 @@ static void hook_sb_delete(struct super_block *const sb)
>  			 * At this point, we own the ihold() reference that was
>  			 * originally set up by get_inode_object() and the
>  			 * __iget() reference that we just set in this loop
> -			 * walk.  Therefore the following call to iput() will
> -			 * not sleep nor drop the inode because there is now at
> -			 * least two references to it.
> +			 * walk.  Therefore there are at least two references
> +			 * on the inode.
>  			 */
> -			iput(inode);
> +			iput_not_last(inode);
>  		} else {
>  			spin_unlock(&object->lock);
>  			rcu_read_unlock();
> -- 
> 2.48.1
> 
>