smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
authorTetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Tue, 19 Oct 2021 11:27:26 +0000 (20:27 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 18 Nov 2021 18:16:39 +0000 (19:16 +0100)
commitc6293f673f2d90949f86afc0f5609182b7915c0c
tree3df693f88168bb5a3d94e6ef5ef69729319c90c4
parent19bbbeb408d0aa3aa5591d17a664423b69fc08e2
smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi

[ Upstream commit 0934ad42bb2c5df90a1b9de690f93de735b622fe ]

syzbot is reporting UAF at cipso_v4_doi_search() [1], for smk_cipso_doi()
is calling kfree() without removing from the cipso_v4_doi_list list after
netlbl_cfg_cipsov4_map_add() returned an error. We need to use
netlbl_cfg_cipsov4_del() in order to remove from the list and wait for
RCU grace period before kfree().

Link: https://syzkaller.appspot.com/bug?extid=93dba5b91f0fed312cbd
Reported-by: syzbot <syzbot+93dba5b91f0fed312cbd@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 6c2e8ac0953fccdd ("netlabel: Update kernel configuration API")
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
security/smack/smackfs.c