Re: [PATCH v3 stable/linux-6.12.y 2/3] lsm: add backing_file LSM hooks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Double execution of LSM backing_file_free hooks on alloc error path
--

commit 2db824f4a305b633b1d25658a509035f0230ff7f
Author: Paul Moore <paul@paul-moore.com>

lsm: add backing_file LSM hooks

This commit adds a security blob to the backing_file struct to allow stacked
filesystems to provide the necessary mechanisms for LSMs to properly enforce
access controls on mmap() and mprotect() operations. Three new LSM hooks are
introduced to manage the lifecycle and access control of the backing file blob.

> diff --git a/fs/file_table.c b/fs/file_table.c
> --- a/fs/file_table.c
> +++ b/fs/file_table.c
[ ... ]
> @@ -293,7 +311,7 @@ struct file *alloc_empty_backing_file(int flags, const struct cred *cred)
>  
>  	/* The f_mode flags must be set before fput(). */
>  	ff->file.f_mode |= FMODE_BACKING | FMODE_NOACCOUNT;
> -	error = init_backing_file(ff);
> +	error = init_backing_file(ff, user_file);
>  	if (unlikely(error)) {
>  		fput(&ff->file);

[Severity: Medium]
Does this error path trigger a double execution of the LSM backing_file_free
hooks?

If security_backing_file_alloc() fails (e.g., due to an LSM hook returning an
error), it already cleans up its own state by calling
security_backing_file_free().

This propagates the error up here, where fput() is called to clean up the
partially initialized file structure.

Calling fput() eventually results in a call to file_free(), which calls
backing_file_free() and invokes security_backing_file_free() a second time.

While the second call safely ignores the NULL blob, it still unconditionally
executes call_void_hook(backing_file_free, backing_file):

void security_backing_file_free(struct file *backing_file)
{
        void *blob = backing_file_security(backing_file);

        call_void_hook(backing_file_free, backing_file);
        ...
}

Could this break the LSM lifecycle contract for future LSMs that might track
backing file state by executing the free hooks twice on the same file?

>  		return ERR_PTR(error);
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629070338.578858-1-caixinchen1@huawei.com?part=2