Infinite loop in get_file_rcu() in face of a saturated ref count

From: Mateusz Guzik
Date: Mon Aug 25 2025 - 17:43:28 EST


__get_file_rcu() bails early:

if (unlikely(!file_ref_get(&file->f_ref)))
return ERR_PTR(-EAGAIN);

But get_file_rcu():
for (;;) {
struct file __rcu *file;

file = __get_file_rcu(f);
if (!IS_ERR(file))
return file;
}

So if this encounters a saturated refcount, the loop with never end.

I don't know what makes the most sense to do here and I'm no position
to mess with any patches.

This is not a serious problem either, so I would put this on the back
burner. Just reporting for interested.
--
Mateusz Guzik <mjguzik gmail.com>