CVE-2024-40913

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: defer exposing anonfd until after copyto_user() succeeds

After installing the anonymous fd, we can now see it in userland and close it. However, at this point we may not have gotten the reference count of the cache, but we will put it during colse fd, so this may cause a cache UAF.

So grab the cache reference count before fdinstall(). In addition, by kernel convention, fd is taken over by the user land after fdinstall(), and the kernel should not call closefd() after that, i.e., it should call fdinstall() after everything is ready, thus fdinstall() is called after copyto_user() succeeds.