In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix dentry leak in cachefilesopenfile()

A dentry leak may be caused when a lookup cookie and a cull are concurrent:

P1 | P2

cachefileslookupcookie cachefileslookupobject lookuponepositiveunlocked // get dentry cachefilescull inode->iflags |= SKERNELFILE; cachefilesopenfile cachefilesmarkinodeinuse _cachefilesmarkinodeinuse canuse = false if (!(inode->iflags & SKERNELFILE)) canuse = true return false return false // Returns an error but doesn't put dentry

After that the following WARNING will be triggered when the backend folder is umounted:

================================================================== BUG: Dentry 000000008ad87947{i=7a,n=Dx11.img} still in use (1) [unmount of ext4 sda] WARNING: CPU: 4 PID: 359261 at fs/dcache.c:1767 umountcheck+0x5d/0x70 CPU: 4 PID: 359261 Comm: umount Not tainted 6.6.0-dirty #25 RIP: 0010:umountcheck+0x5d/0x70 Call Trace: <TASK> dwalk+0xda/0x2b0 doonetree+0x20/0x40 shrinkdcacheforumount+0x2c/0x90 genericshutdownsuper+0x20/0x160 killblocksuper+0x1a/0x40 ext4killsb+0x22/0x40 deactivatelockedsuper+0x35/0x80

cleanup_mnt+0x104/0x160

Whether cachefilesopenfile() returns true or false, the reference count obtained by lookuppositiveunlocked() in cachefileslookup_object() should be released.

Therefore release that reference count in cachefileslookup_object() to fix the above issue and simplify the code.