Re: [PATCH] cred: clarify that task_struct::cred is only for the current task

[Paul Moore <paul@paul-moore.com>]

On Aug  6, 2026 Jann Horn <jannh@google.com> wrote:
> 
> The `cred` field in task_struct is currently marked as __rcu, but that's
> not true: It can point to credentials from access_override_creds(), which
> do not get freed with RCU delay.
> 
> What actually protects task_struct::cred is that accessing it is only
> permitted for the current task (except for setting up a child during fork()
> or tearing down a dead process).
> (There is currently code in Smack that violates this rule, but that's a bug
> and causes UAF, I have sent a separate fix for that.)
> 
> Clarify this, remove the __rcu marker, and remove RCU helpers from all
> accesses to this field.
> 
> Signed-off-by: Jann Horn <jannh@google.com>
> ---
> For context:
> There have been at least two UAFs of struct cred that I'm aware of, both
> caused by wrong use of task_struct::cred:
> 
>  - https://git.kernel.org/linus/a3727a8bac0a9e77c70820655fd8715523ba3db7
>  - https://lore.kernel.org/all/20260806-smack-uaf-fix-v1-1-26426d389a26@google.com/
> ---
>  include/linux/cred.h  | 17 +++++++++++------
>  include/linux/sched.h |  8 ++++++--
>  kernel/auditsc.c      |  5 +++--
>  kernel/cred.c         |  2 +-
>  security/lsm_init.c   |  2 +-
>  5 files changed, 22 insertions(+), 12 deletions(-)

This looks good to me, with one small nit below, but as we are at -rc7
I think this is best kept until after the upcoming merge window so it
has more than a few days in linux-next.  I'm going to merge this into
lsm/dev-staging with the expectation of merging it into lsm/dev after
the upcoming merge window closes.  If anyone wishes to object to this
patch or add their own review/ACK/test tag before then, please do.

Thanks Jann.

> diff --git a/security/lsm_init.c b/security/lsm_init.c
> index 7c0fd17f1601..1328a2ceef4b 100644
> --- a/security/lsm_init.c
> +++ b/security/lsm_init.c
> @@ -476,7 +476,7 @@ int __init security_init(void)
>  						    blob_sizes.lbs_inode, 0,
>  						    SLAB_PANIC, NULL);
>  
> -	if (lsm_cred_alloc((struct cred *)unrcu_pointer(current->cred),
> +	if (lsm_cred_alloc((struct cred *)current->cred,
>  			   GFP_KERNEL))

Just a FYI, but I pulled the GFP_KERNEL up on the line above while
merging since it now fits.

--
paul-moore.com