kernel: handle spinlock from escape_to_root

* Likely fix the freeze in a few kernel version.

Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>
This commit is contained in:
rsuntk
2025-08-19 13:02:49 +07:00
committed by ShirkNeko
parent 210f61949f
commit a17cd29e7a

View File

@@ -122,11 +122,8 @@ static void setup_groups(struct root_profile *profile, struct cred *cred)
put_group_info(group_info); put_group_info(group_info);
} }
static void disable_seccomp(void) static void disable_seccomp(struct task_struct *tsk)
{ {
struct task_struct *tsk = get_current();
spin_lock_irq(&tsk->sighand->siglock);
assert_spin_locked(&tsk->sighand->siglock); assert_spin_locked(&tsk->sighand->siglock);
// disable seccomp // disable seccomp
@@ -139,24 +136,18 @@ static void disable_seccomp(void)
#ifdef CONFIG_SECCOMP #ifdef CONFIG_SECCOMP
tsk->seccomp.mode = 0; tsk->seccomp.mode = 0;
if (tsk->seccomp.filter == NULL) { if (tsk->seccomp.filter) {
pr_warn("tsk->seccomp.filter is NULL already!\n");
goto out;
}
// TODO: Add kernel 6.11+ support // TODO: Add kernel 6.11+ support
// 5.9+ have filter_count and use seccomp_filter_release // 5.9+ have filter_count and use seccomp_filter_release
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 9, 0) #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 9, 0)
seccomp_filter_release(tsk); seccomp_filter_release(tsk);
atomic_set(&tsk->seccomp.filter_count, 0); atomic_set(&tsk->seccomp.filter_count, 0);
#else #else
put_seccomp_filter(tsk); put_seccomp_filter(tsk);
tsk->seccomp.filter = NULL; tsk->seccomp.filter = NULL;
#endif #endif
}
#endif #endif
out:
spin_unlock_irq(&tsk->sighand->siglock);
} }
void escape_to_root(void) void escape_to_root(void)
@@ -207,7 +198,9 @@ void escape_to_root(void)
setup_groups(profile, newcreds); setup_groups(profile, newcreds);
commit_creds(newcreds); commit_creds(newcreds);
disable_seccomp(); spin_lock_irq(&current->sighand->siglock);
disable_seccomp(current);
spin_unlock_irq(&current->sighand->siglock);
setup_selinux(profile->selinux_domain); setup_selinux(profile->selinux_domain);
} }