Re: [PATCH] landlock: Fix superblock use-after-free in release_inode()

[sashiko-bot@kernel.org]

> Without this fix, release_inode() (task 1) can race with a umount operation in
> hook_sb_delete() (task 2).  The order of operations in which the race occurs is:
> 
> * task 2: hook_sb_delete() arrives at the end of the function, waiting for
>   landlock_superblock(sb)->inode_refs to become zero.
> * task 1: release_inode(): does atomic_long_dec_and_test(), decrementing
>   inode_refs to zero.
> * task 2: gets woken up through some other means, sees that inode_refs is
>   zero and returns.  The caller is the unmount operation and proceeds to
>   release the superblock.
> * task 1: Runs wake_up_var(&landlock_superblock(sb)->inode_refs),
>   *dereferencing the sb_security on the freed-up superblock*.
> 
> Notably, wake_up_var() does not dereference the pointer passed to it, and
> only uses it to determine an overapproximated set of tasks to wake up. So
> [ ... ]
> 
> Cc: stable@vger.kernel.org
> Fixes: cb2c7d1a1776 ("landlock: Support filesystem access-control")
> Assisted-by: LLM
> Signed-off-by: Günther Noack <gnoack@google.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261006105847.2541190-1-gnoack@google.com?part=1