Re: Infinite loop in get_file_rcu() in face of a saturated ref count

[Christian Brauner <brauner@kernel.org>]

On Mon, Aug 25, 2025 at 11:43:00PM +0200, Mateusz Guzik wrote:
> __get_file_rcu() bails early:
> 
>         if (unlikely(!file_ref_get(&file->f_ref)))
>                 return ERR_PTR(-EAGAIN);
> 
> But get_file_rcu():
>        for (;;) {
>                 struct file __rcu *file;
> 
>                 file = __get_file_rcu(f);
>                 if (!IS_ERR(file))
>                         return file;
>         }
> 
> So if this encounters a saturated refcount, the loop with never end.
> 
> I don't know what makes the most sense to do here and I'm no position
> to mess with any patches.
> 
> This is not a serious problem either, so I would put this on the back
> burner. Just reporting for interested.

That's like past 2^63 - 1 references. Apart from an odd bug is that
really something to worry about. I mean, we can add a VFS_WARN_ON_ONCE()
in there of course but specifically handling that in the code doesn't
seem sensible to me.