mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-03-30 04:47:43 -04:00
Code Issues Packages Projects Releases Wiki Activity

landlock: Clean up interrupted thread logic in TSYNC

Browse Source 
In landlock_restrict_sibling_threads(), when the calling thread is
interrupted while waiting for sibling threads to prepare, it executes
a recovery path.

Previously, this path included a wait_for_completion() call on
all_prepared to prevent a Use-After-Free of the local shared_ctx.
However, this wait is redundant. Exiting the main do-while loop
already leads to a bottom cleanup section that unconditionally waits
for all_finished. Therefore, replacing the wait with a simple break
is safe, prevents UAF, and correctly unblocks the remaining task_works.

Clean up the error path by breaking the loop and updating the
surrounding comments to accurately reflect the state machine.

Suggested-by: Günther Noack <gnoack3000@gmail.com>
Signed-off-by: Yihan Ding <dingyihan@uniontech.com>
Tested-by: Günther Noack <gnoack3000@gmail.com>
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20260306021651.744723-3-dingyihan@uniontech.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
This commit is contained in:
Yihan Ding
2026-03-06 10:16:51 +08:00
committed by Mickaël Salaün
parent ff88df67db
commit 697f514ad9
1 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
security/landlock/tsync.c
View File

@@ -575,24 +575,30 @@ int landlock_restrict_sibling_threads(const struct cred *old_cred,
-ERESTARTNOINTR);
/*
* Cancel task works for tasks that did not start running yet,
* and decrement all_prepared and num_unfinished accordingly.
* Opportunistic improvement: try to cancel task
* works for tasks that did not start running
* yet. We do not have a guarantee that it
* cancels any of the enqueued task works
* because task_work_run() might already have
* dequeued them.
*/
cancel_tsync_works(&works, &shared_ctx);
/*
* The remaining task works have started running, so waiting for
* their completion will finish.
* Break the loop with error. The cleanup code
* after the loop unblocks the remaining
* task_works.
*/
wait_for_completion(&shared_ctx.all_prepared);
break;
}
}
} while (found_more_threads &&
!atomic_read(&shared_ctx.preparation_error));
/*
* We now have all sibling threads blocking and in "prepared" state in the
* task work. Ask all threads to commit.
* We now have either (a) all sibling threads blocking and in "prepared"
* state in the task work, or (b) the preparation error is set. Ask all
* threads to commit (or abort).
*/
complete_all(&shared_ctx.ready_to_commit);