Re: [PATCH] cred: clarify that task_struct::cred is only for the current task

["Serge E. Hallyn" <serge@hallyn.com>]

On Mon, Aug 10, 2026 at 03:41:54PM -0400, Paul Moore wrote:
> On Aug  6, 2026 Jann Horn <jannh@google.com> wrote:
> > 
> > The `cred` field in task_struct is currently marked as __rcu, but that's
> > not true: It can point to credentials from access_override_creds(), which
> > do not get freed with RCU delay.
> > 
> > What actually protects task_struct::cred is that accessing it is only
> > permitted for the current task (except for setting up a child during fork()
> > or tearing down a dead process).
> > (There is currently code in Smack that violates this rule, but that's a bug
> > and causes UAF, I have sent a separate fix for that.)
> > 
> > Clarify this, remove the __rcu marker, and remove RCU helpers from all
> > accesses to this field.
> > 
> > Signed-off-by: Jann Horn <jannh@google.com>
> > ---
> > For context:
> > There have been at least two UAFs of struct cred that I'm aware of, both
> > caused by wrong use of task_struct::cred:
> > 
> >  - https://git.kernel.org/linus/a3727a8bac0a9e77c70820655fd8715523ba3db7
> >  - https://lore.kernel.org/all/20260806-smack-uaf-fix-v1-1-26426d389a26@google.com/
> > ---
> >  include/linux/cred.h  | 17 +++++++++++------
> >  include/linux/sched.h |  8 ++++++--
> >  kernel/auditsc.c      |  5 +++--
> >  kernel/cred.c         |  2 +-
> >  security/lsm_init.c   |  2 +-
> >  5 files changed, 22 insertions(+), 12 deletions(-)
> 
> This looks good to me, with one small nit below, but as we are at -rc7
> I think this is best kept until after the upcoming merge window so it
> has more than a few days in linux-next.  I'm going to merge this into
> lsm/dev-staging with the expectation of merging it into lsm/dev after
> the upcoming merge window closes.  If anyone wishes to object to this
> patch or add their own review/ACK/test tag before then, please do.
> 
> Thanks Jann.
> 

Thanks.  FWIW I did also look at this closely.

Reviewed-by: Serge Hallyn <serge@hallyn.com>

> > diff --git a/security/lsm_init.c b/security/lsm_init.c
> > index 7c0fd17f1601..1328a2ceef4b 100644
> > --- a/security/lsm_init.c
> > +++ b/security/lsm_init.c
> > @@ -476,7 +476,7 @@ int __init security_init(void)
> >  						    blob_sizes.lbs_inode, 0,
> >  						    SLAB_PANIC, NULL);
> >  
> > -	if (lsm_cred_alloc((struct cred *)unrcu_pointer(current->cred),
> > +	if (lsm_cred_alloc((struct cred *)current->cred,
> >  			   GFP_KERNEL))
> 
> Just a FYI, but I pulled the GFP_KERNEL up on the line above while
> merging since it now fits.
> 
> --
> paul-moore.com