[PATCH v2 2/2] security: Fix call security_backing_file_free second time

[Paul Moore]

On Thu, Aug 27, 2026 at 12:30 PM Paul Moore <paul at paul-moore.com> wrote:
> On Jul  7, 2026 Cai Xinchen <caixinchen1 at huawei.com> wrote:
> >
> > I found the following path:
> >
> > alloc_empty_backing-file
> >     init_file(&ff->file, xxx)
> >         -> file_ref_init(&f->f_ref, 1); // only 1
> >     error = init_backing_file
> >         -> security_backing_file_alloc
> >         -> rc = call_int_hook(backing_file_alloc, ...)
> >            if (unlikely(rc))
> >               security_backing_file_free(backing_file); // first call
> >     if (unlikely(error)) {
> >         fput(&ff->file);
> >          -> if (unlikely(file_ref_put(&file->f_ref))) // zero
> >                 __fput_deferred(file);
> >                  -> ____fput -> __fput -> file_free(file);
> >                  -> backing_file_free(backing_file(f));
> >                  -> security_backing_file_free(&ff->file); // second call
> >
> > Currently, only SELinux has the lsm backing_file_alloc hook, and it always
> > return 0. When security_backing_file_free is called for the first time,
> > the blobs pointer is set to NULL. Therefore, double free will not occur in
> > the code.
> >
> > Fixes: 6af36aeb147a ("lsm: add backing_file LSM hooks")
> > Signed-off-by: Cai Xinchen <caixinchen1 at huawei.com>
> > ---
> >  security/security.c | 3 +--
> >  1 file changed, 1 insertion(+), 2 deletions(-)
>
> Merged into lsm/dev-staging, will be moved to lsm/dev after the merge
> window.

This is now in lsm/dev, thanks!

-- 
paul-moore.com