[PATCH 1/5] fs: Do not allow get_file() to resurrect 0 f_count

Kees Cook
2024-05-02T22:33:46Z

If f_count reaches 0, calling get_file() should be a failure. Adjust to
use atomic_long_inc_not_zero() and return NULL on failure. In the future
get_file() can be annotated with __must_check, though that is not
currently possible.

Signed-off-by: Kees Cook <keescook@chromium.org>
---
Cc: Christian Brauner <brauner@kernel.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Jan Kara <jack@suse.cz>
Cc: linux-fsdevel@vger.kernel.org
---
include/linux/fs.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 00fc429b0af0..210bbbfe9b83 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1038,7 +1038,8 @@ struct file_handle {

static inline struct file *get_file(struct file *f)
{
- atomic_long_inc(&f->f_count);
+ if (unlikely(!atomic_long_inc_not_zero(&f->f_count)))
+ return NULL;
return f;
}

--
2.34.1