[PATCH] landlock: Fix domain leak on concurrent F_SETOWN and file release

@@ -1971,8 +1971,49 @@ static void hook_file_set_fowner(struct file *file)
 	put_pid(prev_tg);
 }
 
+/*
+ * Drops the Landlock references saved by hook_file_set_fowner(), in a
+ * critical section serialized with it thanks to file->f_owner->lock, and
+ * before file_f_owner_release() frees this lock.  Without this mutual
+ * exclusion, a concurrent F_SETOWN could store a new domain reference into a
+ * file being released (the last fput() made it unreachable to future F_SETOWN
+ * users), which would then never be dropped, leaking the whole domain.
+ */
+static void hook_file_release(struct file *file)
+{
+	struct landlock_ruleset *prev_dom;
+	struct pid *prev_tg;
+	struct fown_struct *fown;
+
+	fown = file_f_owner(file);
+	if (!fown)
+		/* No owner was ever recorded, cf. hook_file_set_fowner(). */
+		return;
+
+	/*
+	 * __fput() calls this hook before file_f_owner_release(), so the
+	 * fown_struct is still alive here.
+	 */
+	write_lock_irq(&fown->lock);
+	prev_dom = landlock_file(file)->fown_subject.domain;
+	prev_tg = landlock_file(file)->fown_tg;
+	landlock_file(file)->fown_subject.domain = NULL;
+	landlock_file(file)->fown_tg = NULL;
+	write_unlock_irq(&fown->lock);
+
+	/* May be called in an RCU read-side critical section. */
+	landlock_put_ruleset_deferred(prev_dom);
+	put_pid(prev_tg);
+}
+
 static void hook_file_free_security(struct file *file)
 {
+	/*
+	 * hook_file_release() already dropped and cleared these references if
+	 * they were ever recorded.  Keep a defensive cleanup for files without
+	 * a fown_struct (e.g. never owning files), which hook_file_release()
+	 * skips.
+	 */
 	put_pid(landlock_file(file)->fown_tg);
 	landlock_put_ruleset_deferred(landlock_file(file)->fown_subject.domain);
 }

@@ -2003,6 +2044,7 @@ static struct security_hook_list landlock_hooks[] __ro_after_init = {
 	LSM_HOOK_INIT(file_ioctl, hook_file_ioctl),
 	LSM_HOOK_INIT(file_ioctl_compat, hook_file_ioctl_compat),
 	LSM_HOOK_INIT(file_set_fowner, hook_file_set_fowner),
+	LSM_HOOK_INIT(file_release, hook_file_release),
 	LSM_HOOK_INIT(file_free_security, hook_file_free_security),
 };