[PATCH] smack: reject relabel-self writes from io_uring workers

[PATCH] smack: reject relabel-self writes from io_uring workers

[Nguyen Ngoc Thang]

smk_write_relabel_self() calls commit_creds() on current. When the write
is issued through io_uring it runs on an io-wq worker, and io_uring
override_creds()es the submitter's creds when they differ from the
worker's. commit_creds() then trips BUG_ON(task->cred != task->real_cred):

  kernel BUG at kernel/cred.c:376!
  commit_creds
  smk_write_relabel_self
  loop_rw_iter
  io_write
  io_wq_submit_work
  io_worker_handle_work
  io_wq_worker

Even without the override, committing creds on a worker would relabel
the worker rather than the submitting task. Refuse the write from
PF_IO_WORKER context.

Fixes: 38416e53936e ("Smack: limited capability for changing process label")
Reported-by: syzbot+fa63184795283ac3f842@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fa63184795283ac3f842
Cc: stable@vger.kernel.org
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
Reproduced under QEMU (x86, v7.3-rc3 + 00834fcb20d0) with a small io_uring
program: async IORING_OP_WRITE to /sys/fs/smackfs/relabel-self to spawn
the worker, a direct write() to change the submitter's creds, then a
second async write. Before: BUG at kernel/cred.c:376. After: the write
fails with -EOPNOTSUPP and the program completes.

 security/smack/smackfs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index a72bc7fabea9..0061220e2d00 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -2678,6 +2678,10 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf,
 	if (!smack_privileged(CAP_MAC_ADMIN))
 		return -EPERM;
 
+	/* commit_creds() must act on the caller, not an io_uring worker. */
+	if (current->flags & PF_IO_WORKER)
+		return -EOPNOTSUPP;
+
 	/*
 	 * No partial write.
 	 * Enough data must be present.
-- 
2.43.0

Re: [PATCH] smack: reject relabel-self writes from io_uring workers

[sashiko-bot]

> smk_write_relabel_self() calls commit_creds() on current. When the write
> is issued through io_uring it runs on an io-wq worker, and io_uring
> override_creds()es the submitter's creds when they differ from the
> worker's. commit_creds() then trips BUG_ON(task->cred != task->real_cred):
> 
>   kernel BUG at kernel/cred.c:376!
>   commit_creds
>   smk_write_relabel_self
>   loop_rw_iter
>   io_write
>   io_wq_submit_work
>   io_worker_handle_work
>   io_wq_worker
> 
> Even without the override, committing creds on a worker would relabel
> the worker rather than the submitting task. Refuse the write from
> PF_IO_WORKER context.
> 
> Fixes: 38416e53936e ("Smack: limited capability for changing process label")
> Reported-by: syzbot+fa63184795283ac3f842@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=fa63184795283ac3f842
> Cc: stable@vger.kernel.org
> Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919035351.88453-1-ngocthang2710.1999@gmail.com?part=1