diff options
| author | Jann Horn <jannh@google.com> | 2026-08-06 22:15:54 +0200 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2026-08-31 16:14:09 -0400 |
| commit | b030ffaedc1d638f232f6992406cdcdcc82d5602 (patch) | |
| tree | 2802f24962af082633e86f5e86db43d7334e7d9c /security | |
| parent | cee9395acd8043be0644b25c34bfa86623f2b935 (diff) | |
| download | linux-next-b030ffaedc1d638f232f6992406cdcdcc82d5602.tar.gz linux-next-b030ffaedc1d638f232f6992406cdcdcc82d5602.zip | |
cred: clarify that task_struct::cred is only for the current task
The `cred` field in task_struct is currently marked as __rcu, but that's
not true: It can point to credentials from access_override_creds(), which
do not get freed with RCU delay.
What actually protects task_struct::cred is that accessing it is only
permitted for the current task (except for setting up a child during fork()
or tearing down a dead process).
(There is currently code in Smack that violates this rule, but that's a bug
and causes UAF, I have sent a separate fix for that.)
Clarify this, remove the __rcu marker, and remove RCU helpers from all
accesses to this field.
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
[PM: style tweak in security_init(), applied fixup from JH]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/lsm_init.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/security/lsm_init.c b/security/lsm_init.c index a1ad641811de..04b18d06ba59 100644 --- a/security/lsm_init.c +++ b/security/lsm_init.c @@ -476,8 +476,7 @@ int __init security_init(void) blob_sizes.lbs_inode, 0, SLAB_PANIC, NULL); - if (lsm_cred_alloc((struct cred *)unrcu_pointer(current->cred), - GFP_KERNEL)) + if (lsm_cred_alloc((struct cred *)current->cred, GFP_KERNEL)) panic("early LSM cred alloc failed\n"); if (lsm_task_alloc(current)) panic("early LSM task alloc failed\n"); |