[PATCH -next] lockdown: Add break in lockdown_write

[PATCH -next] lockdown: Add break in lockdown_write

[Cai Xinchen]

After the label is matched successful, any other levels judgements
are meaningless. Therefore, add break to return early

Signed-off-by: Cai Xinchen <caixinchen1@huawei.com>
---
 security/lockdown/lockdown.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index 8d46886d2cca..263dcc80d839 100644
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c
@@ -139,8 +139,10 @@ static ssize_t lockdown_write(struct file *file, const char __user *buf,
 		enum lockdown_reason level = lockdown_levels[i];
 		const char *label = lockdown_reasons[level];
 
-		if (label && !strcmp(state, label))
+		if (label && !strcmp(state, label)) {
 			err = lock_kernel_down("securityfs", level);
+			break;
+		}
 	}
 
 	kfree(state);
-- 
2.34.1

Re: [PATCH -next] lockdown: Add break in lockdown_write

[Xiu Jianfeng]

On 1/19/2026 5:12 PM, Cai Xinchen wrote:
> After the label is matched successful, any other levels judgements
> are meaningless. Therefore, add break to return early
> 
> Signed-off-by: Cai Xinchen <caixinchen1@huawei.com>

Looks good to me, thanks.

Acked-by: Xiu Jianfeng <xiujianfeng@huawei.com>

Paul,

Would you mind if this patch went through the LSM tree? :)

Best regards
Xiu Jianfeng

Re: [PATCH -next] lockdown: Add break in lockdown_write

[Paul Moore]

On Thu, Jan 22, 2026 at 4:31 AM Xiu Jianfeng <xiujianfeng@huawei.com> wrote:
> On 1/19/2026 5:12 PM, Cai Xinchen wrote:
> > After the label is matched successful, any other levels judgements
> > are meaningless. Therefore, add break to return early
> >
> > Signed-off-by: Cai Xinchen <caixinchen1@huawei.com>
>
> Looks good to me, thanks.
>
> Acked-by: Xiu Jianfeng <xiujianfeng@huawei.com>
>
> Paul,
>
> Would you mind if this patch went through the LSM tree? :)

Assuming Nicolas is okay with that, I can take this through the LSM tree.

-- 
paul-moore.com

Re: [PATCH -next] lockdown: Add break in lockdown_write

[Paul Moore]

On Thu, Jan 22, 2026 at 12:41 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Thu, Jan 22, 2026 at 4:31 AM Xiu Jianfeng <xiujianfeng@huawei.com> wrote:
> > On 1/19/2026 5:12 PM, Cai Xinchen wrote:
> > > After the label is matched successful, any other levels judgements
> > > are meaningless. Therefore, add break to return early
> > >
> > > Signed-off-by: Cai Xinchen <caixinchen1@huawei.com>
> >
> > Looks good to me, thanks.
> >
> > Acked-by: Xiu Jianfeng <xiujianfeng@huawei.com>
> >
> > Paul,
> >
> > Would you mind if this patch went through the LSM tree? :)
>
> Assuming Nicolas is okay with that, I can take this through the LSM tree.

Following up on this as I never saw a response on-list and the patch
doesn't appear to be in Linus' tree.

-- 
paul-moore.com

Re: [PATCH -next] lockdown: Add break in lockdown_write

[Nicolas Bouchinet]

On Thu, Jul 02, 2026 at 12:50:18PM -0400, Paul Moore wrote:
> On Thu, Jan 22, 2026 at 12:41???PM Paul Moore <paul@paul-moore.com> wrote:
> >
> > On Thu, Jan 22, 2026 at 4:31???AM Xiu Jianfeng <xiujianfeng@huawei.com> wrote:
> > > On 1/19/2026 5:12 PM, Cai Xinchen wrote:
> > > > After the label is matched successful, any other levels judgements
> > > > are meaningless. Therefore, add break to return early
> > > >
> > > > Signed-off-by: Cai Xinchen <caixinchen1@huawei.com>
> > >
> > > Looks good to me, thanks.
> > >
> > > Acked-by: Xiu Jianfeng <xiujianfeng@huawei.com>
> > >
> > > Paul,
> > >
> > > Would you mind if this patch went through the LSM tree? :)
> >
> > Assuming Nicolas is okay with that, I can take this through the LSM tree.
> 
> Following up on this as I never saw a response on-list and the patch
> doesn't appear to be in Linus' tree.

Your right, my bad,

First of all, thanks Cai for your contribution and I appologize for the
really late reply.

This is pretty much the same kind of patch as [1], while it effectively
cleans up Lockdown code, in my opinion it doesn't directly add much. I'd
personally prefer to keep those small patches on hold for now, waiting
for a bigger review of Lockdown's code where I will pick them both up.
Sadly, I really don't have much time to work on this right now.

Nicolas

---

[1]: https://lore.kernel.org/all/20260501174448.47154-1-kalevi@kolttonen.fi/