]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
authorJiawei Ye <jiawei.ye@foxmail.com>
Mon, 2 Sep 2024 08:47:26 +0000 (08:47 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 4 Oct 2024 14:29:20 +0000 (16:29 +0200)
commit72eef5226fbef8b8d6108f55becb301f79ec2b3e
treec500b866ff24dd0f21eabfd02698bdd42db41ef6
parente4006410b0f53a91f332c9b90ea35637cbc21659
smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso

[ Upstream commit 2749749afa071f8a0e405605de9da615e771a7ce ]

In the `smk_set_cipso` function, the `skp->smk_netlabel.attr.mls.cat`
field is directly assigned to a new value without using the appropriate
RCU pointer assignment functions. According to RCU usage rules, this is
illegal and can lead to unpredictable behavior, including data
inconsistencies and impossible-to-diagnose memory corruption issues.

This possible bug was identified using a static analysis tool developed
by myself, specifically designed to detect RCU-related issues.

To address this, the assignment is now done using rcu_assign_pointer(),
which ensures that the pointer assignment is done safely, with the
necessary memory barriers and synchronization. This change prevents
potential RCU dereference issues by ensuring that the `cat` field is
safely updated while still adhering to RCU's requirements.

Fixes: 0817534ff9ea ("smackfs: Fix use-after-free in netlbl_catmap_walk()")
Signed-off-by: Jiawei Ye <jiawei.ye@foxmail.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
security/smack/smackfs.c