[PATCH -next 0/2] Fix call security_backing_file_free second time

[Cai Xinchen]

I found the following path:

alloc_empty_backing-file
    init_file(&ff->file, xxx)
        -> file_ref_init(&f->f_ref, 1); // only 1
    error = init_backing_file
        -> security_backing_file_alloc
        -> rc = call_int_hook(backing_file_alloc, ...)
           if (unlikely(rc))
                security_backing_file_free(backing_file); // first call
    if (unlikely(error)) {
        fput(&ff->file);
         -> if (unlikely(file_ref_put(&file->f_ref))) // zero
                __fput_deferred(file);
                 -> ____fput -> __fput -> file_free(file);
                 -> backing_file_free(backing_file(f));
                 -> security_backing_file_free(&ff->file); // second call

Cai Xinchen (2):
  security: Some cleanup code
  security: Fix call security_backing_file_free second time

 security/lsm_init.c      | 1 -
 security/security.c      | 5 +----
 security/selinux/hooks.c | 1 -
 3 files changed, 1 insertion(+), 6 deletions(-)

-- 
2.34.1