Tetsuo Handa 2caa605079 tomoyo: fix UAF write bug in tomoyo_write_control() ...

commit 2f03fc340c upstream.

Since tomoyo_write_control() updates head->write_buf when write()
of long lines is requested, we need to fetch head->write_buf after
head->io_sem is held.  Otherwise, concurrent write() requests can
cause use-after-free-write and double-free problems.

Reported-by: Sam Sun <samsun1006219@gmail.com>
Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji8g@mail.gmail.com
Fixes: bd03a3e4c9 ("TOMOYO: Add policy namespace support.")
Cc:  <stable@vger.kernel.org> # Linux 3.1+
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2024-03-06 14:48:39 +00:00

..

apparmor

apparmor: avoid crash when parsed profile name is empty

2024-01-25 15:35:54 -08:00

bpf

selinux: remove the runtime disable functionality

2023-03-20 12:34:23 -04:00

integrity

ima: detect changes to the backing overlay file

2023-11-28 17:20:03 +00:00

keys

Revert "KEYS: encrypted: Add check for strsep"

2024-01-25 15:36:01 -08:00

landlock

landlock: Annotate struct landlock_rule with __counted_by

2023-08-18 11:44:42 +02:00

loadpin

LoadPin: Annotate struct dm_verity_loadpin_trusted_root_digest with __counted_by

2023-08-25 16:07:30 -07:00

lockdown

selinux: remove the runtime disable functionality

2023-03-20 12:34:23 -04:00

safesetid

SafeSetID: fix UID printed instead of GID

2023-06-20 20:26:00 -04:00

selinux

lsm: new security_file_ioctl_compat() hook

2024-01-31 16:18:54 -08:00

smack

lsm: new security_file_ioctl_compat() hook

2024-01-31 16:18:54 -08:00

tomoyo

tomoyo: fix UAF write bug in tomoyo_write_control()

2024-03-06 14:48:39 +00:00

yama

Merge tag 'sysctl-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux

2023-04-27 16:52:33 -07:00

commoncap.c

lsm: constify the 'target' parameter in security_capget()

2023-08-08 16:48:47 -04:00

device_cgroup.c

device_cgroup: Fix kernel-doc warnings in device_cgroup

2023-06-21 09:30:49 -04:00

inode.c

security: convert to ctime accessor functions

2023-07-24 10:30:08 +02:00

Kconfig

mm/slab: remove HAVE_HARDENED_USERCOPY_ALLOCATOR

2023-05-24 15:38:17 +02:00

Kconfig.hardening

hardening: Move BUG_ON_DATA_CORRUPTION to hardening options

2023-08-15 14:57:25 -07:00

lsm_audit.c

lsm: fix a number of misspellings

2023-05-25 17:52:15 -04:00

Makefile

security: remove unneeded subdir-$(CONFIG_...)

2021-09-03 08:17:20 +09:00

min_addr.c

…

security.c

lsm: fix the logic in security_inode_getsecctx()

2024-02-23 09:25:02 +01:00