landlock: Clean up interrupted thread logic in TSYNC

In landlock_restrict_sibling_threads(), when the calling thread is
interrupted while waiting for sibling threads to prepare, it executes
a recovery path.

Previously, this path included a wait_for_completion() call on
all_prepared to prevent a Use-After-Free of the local shared_ctx.
However, this wait is redundant. Exiting the main do-while loop
already leads to a bottom cleanup section that unconditionally waits
for all_finished. Therefore, replacing the wait with a simple break
is safe, prevents UAF, and correctly unblocks the remaining task_works.

Clean up the error path by breaking the loop and updating the
surrounding comments to accurately reflect the state machine.

Suggested-by: Günther Noack <gnoack3000@gmail.com>
Signed-off-by: Yihan Ding <dingyihan@uniontech.com>
Tested-by: Günther Noack <gnoack3000@gmail.com>
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20260306021651.744723-3-dingyihan@uniontech.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>

diff --git a/security/landlock/tsync.c b/security/landlock/tsync.c
index f0e5f8102001afa44452aba90fbd5ea7d0fe3c28..4d4427ba8d93952dcbaf6c9918336ca367ecebfe 100644 (file)
--- a/security/landlock/tsync.c
+++ b/security/landlock/tsync.c
@@ -575,24 +575,30 @@ int landlock_restrict_sibling_threads(const struct cred *old_cred,
                                           -ERESTARTNOINTR);
 
                                /*
-                                * Cancel task works for tasks that did not start running yet,
-                                * and decrement all_prepared and num_unfinished accordingly.
+                                * Opportunistic improvement: try to cancel task
+                                * works for tasks that did not start running
+                                * yet. We do not have a guarantee that it
+                                * cancels any of the enqueued task works
+                                * because task_work_run() might already have
+                                * dequeued them.
                                 */
                                cancel_tsync_works(&works, &shared_ctx);
 
                                /*
-                                * The remaining task works have started running, so waiting for
-                                * their completion will finish.
+                                * Break the loop with error. The cleanup code
+                                * after the loop unblocks the remaining
+                                * task_works.
                                 */
-                               wait_for_completion(&shared_ctx.all_prepared);
+                               break;
                        }
                }
        } while (found_more_threads &&
                 !atomic_read(&shared_ctx.preparation_error));
 
        /*
-        * We now have all sibling threads blocking and in "prepared" state in the
-        * task work. Ask all threads to commit.
+        * We now have either (a) all sibling threads blocking and in "prepared"
+        * state in the task work, or (b) the preparation error is set. Ask all
+        * threads to commit (or abort).
         */
        complete_all(&shared_ctx.ready_to_commit);