• Jiawei Ye's avatar
    smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso · 2749749a
    Jiawei Ye authored
    In the `smk_set_cipso` function, the `skp->smk_netlabel.attr.mls.cat`
    field is directly assigned to a new value without using the appropriate
    RCU pointer assignment functions. According to RCU usage rules, this is
    illegal and can lead to unpredictable behavior, including data
    inconsistencies and impossible-to-diagnose memory corruption issues.
    
    This possible bug was identified using a static analysis tool developed
    by myself, specifically designed to detect RCU-related issues.
    
    To address this, the assignment is now done using rcu_assign_pointer(),
    which ensures that the pointer assignment is done safely, with the
    necessary memory barriers and synchronization. This change prevents
    potential RCU dereference issues by ensuring that the `cat` field is
    safely updated while still adhering to RCU's requirements.
    
    Fixes: 0817534f ("smackfs: Fix use-after-free in netlbl_catmap_walk()")
    Signed-off-by: default avatarJiawei Ye <jiawei.ye@foxmail.com>
    Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
    2749749a
smackfs.c 69.9 KB