On Aug 6, 2026 Jann Horn <[email protected]> wrote: > > The `cred` field in task_struct is currently marked as __rcu, but that's > not true: It can point to credentials from access_override_creds(), which > do not get freed with RCU delay. > > What actually protects task_struct::cred is that accessing it is only > permitted for the current task (except for setting up a child during fork() > or tearing down a dead process). > (There is currently code in Smack that violates this rule, but that's a bug > and causes UAF, I have sent a separate fix for that.) > > Clarify this, remove the __rcu marker, and remove RCU helpers from all > accesses to this field. > > Signed-off-by: Jann Horn <[email protected]> > --- > For context: > There have been at least two UAFs of struct cred that I'm aware of, both > caused by wrong use of task_struct::cred: > > - https://git.kernel.org/linus/a3727a8bac0a9e77c70820655fd8715523ba3db7 > - > https://lore.kernel.org/all/[email protected]/ > --- > include/linux/cred.h | 17 +++++++++++------ > include/linux/sched.h | 8 ++++++-- > kernel/auditsc.c | 5 +++-- > kernel/cred.c | 2 +- > security/lsm_init.c | 2 +- > 5 files changed, 22 insertions(+), 12 deletions(-)
This looks good to me, with one small nit below, but as we are at -rc7 I think this is best kept until after the upcoming merge window so it has more than a few days in linux-next. I'm going to merge this into lsm/dev-staging with the expectation of merging it into lsm/dev after the upcoming merge window closes. If anyone wishes to object to this patch or add their own review/ACK/test tag before then, please do. Thanks Jann. > diff --git a/security/lsm_init.c b/security/lsm_init.c > index 7c0fd17f1601..1328a2ceef4b 100644 > --- a/security/lsm_init.c > +++ b/security/lsm_init.c > @@ -476,7 +476,7 @@ int __init security_init(void) > blob_sizes.lbs_inode, 0, > SLAB_PANIC, NULL); > > - if (lsm_cred_alloc((struct cred *)unrcu_pointer(current->cred), > + if (lsm_cred_alloc((struct cred *)current->cred, > GFP_KERNEL)) Just a FYI, but I pulled the GFP_KERNEL up on the line above while merging since it now fits. -- paul-moore.com
