]> git.proxmox.com Git - mirror_ubuntu-focal-kernel.git/commit
smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
authorTetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Tue, 19 Oct 2021 11:27:26 +0000 (20:27 +0900)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Thu, 13 Jan 2022 17:42:25 +0000 (18:42 +0100)
commitc981ac8d578800fec7e6f37b5b7a8e0d4c8aa3de
treef6aec9239cda00b034043e3218ce7c11bfd699d0
parenteff4374c113b774f131622d493da0a54428e4ac7
smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi

BugLink: https://bugs.launchpad.net/bugs/1953387
[ Upstream commit 0934ad42bb2c5df90a1b9de690f93de735b622fe ]

syzbot is reporting UAF at cipso_v4_doi_search() [1], for smk_cipso_doi()
is calling kfree() without removing from the cipso_v4_doi_list list after
netlbl_cfg_cipsov4_map_add() returned an error. We need to use
netlbl_cfg_cipsov4_del() in order to remove from the list and wait for
RCU grace period before kfree().

Link: https://syzkaller.appspot.com/bug?extid=93dba5b91f0fed312cbd
Reported-by: syzbot <syzbot+93dba5b91f0fed312cbd@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 6c2e8ac0953fccdd ("netlabel: Update kernel configuration API")
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kelsey Skunberg <kelsey.skunberg@canonical.com>
security/smack/smackfs.c