Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e8c1082c authored by Jiawei Ye's avatar Jiawei Ye Committed by Greg Kroah-Hartman
Browse files

smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso 



[ Upstream commit 2749749afa071f8a0e405605de9da615e771a7ce ]

In the `smk_set_cipso` function, the `skp->smk_netlabel.attr.mls.cat`
field is directly assigned to a new value without using the appropriate
RCU pointer assignment functions. According to RCU usage rules, this is
illegal and can lead to unpredictable behavior, including data
inconsistencies and impossible-to-diagnose memory corruption issues.

This possible bug was identified using a static analysis tool developed
by myself, specifically designed to detect RCU-related issues.

To address this, the assignment is now done using rcu_assign_pointer(),
which ensures that the pointer assignment is done safely, with the
necessary memory barriers and synchronization. This change prevents
potential RCU dereference issues by ensuring that the `cat` field is
safely updated while still adhering to RCU's requirements.

Fixes: 0817534ff9ea ("smackfs: Fix use-after-free in netlbl_catmap_walk()")
Signed-off-by: default avatarJiawei Ye <jiawei.ye@foxmail.com>
Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 22e130fe

security/smack/smackfs.c

+1 −1
Original line number Diff line number Diff line
@@ -920,7 +920,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, 
	rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);

	if (rc >= 0) {

		old_cat = skp->smk_netlabel.attr.mls.cat;

		skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;

		rcu_assign_pointer(skp->smk_netlabel.attr.mls.cat, ncats.attr.mls.cat);

		skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;

		synchronize_rcu();

		netlbl_catmap_free(old_cat);