CVE-2024-56549

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: Fix NULL pointer dereference in object->file

At present, the object->file has the NULL pointer dereference problem in

ondemand-mode. The root cause is that the allocated fd and object->file

lifetime are inconsistent, and the user-space invocation to anon_fd uses

object->file. Following is the process that triggers the issue:

[write fd] [umount]

cachefiles_ondemand_fd_write_iter

fscache_cookie_state_machine

cachefiles_withdraw_cookie

if (!file) return -ENOBUFS

cachefiles_clean_up_object

cachefiles_unmark_inode_in_use

fput(object->file)

object->file = NULL

// file NULL pointer dereference!

__cachefiles_write(..., file, ...)

Fix this issue by add an additional reference count to the object->file

before write/llseek, and decrement after it finished.