Skip to content
Snippets Groups Projects
Commit 0817534f authored by Pawan Gupta's avatar Pawan Gupta Committed by Casey Schaufler
Browse files

smackfs: Fix use-after-free in netlbl_catmap_walk()

Syzkaller reported use-after-free bug as described in [1]. The bug is
triggered when smk_set_cipso() tries to free stale category bitmaps
while there are concurrent reader(s) using the same bitmaps.

Wait for RCU grace period to finish before freeing the category bitmaps
in smk_set_cipso(). This makes sure that there are no more readers using
the stale bitmaps and freeing them should be safe.

[1] https://lore.kernel.org/netdev/000000000000a814c505ca657a4e@google.com/



Reported-by: default avatar <syzbot+3f91de0b813cc3d19a80@syzkaller.appspotmail.com>
Signed-off-by: default avatarPawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
parent 6880fa6c
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment