iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
885dd75f41
linux/security/tomoyo
History
Tetsuo Handa 2f03fc340c tomoyo: fix UAF write bug in tomoyo_write_control() 
Since tomoyo_write_control() updates head->write_buf when write()
of long lines is requested, we need to fetch head->write_buf after
head->io_sem is held.  Otherwise, concurrent write() requests can
cause use-after-free-write and double-free problems.

Reported-by: Sam Sun <samsun1006219@gmail.com>
Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji8g@mail.gmail.com
Fixes: bd03a3e4c9 ("TOMOYO: Add policy namespace support.")
Cc:  <stable@vger.kernel.org> # Linux 3.1+
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2024-03-01 11:14:00 -08:00
..
policy
.gitignore .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
audit.c tomoyo: replace tomoyo_round2() with kmalloc_size_roundup() 2023-03-01 23:46:12 +09:00
common.c tomoyo: fix UAF write bug in tomoyo_write_control() 2024-03-01 11:14:00 -08:00
common.h tomoyo: remove unused function declaration 2023-08-13 22:07:15 +09:00
condition.c tomoyo: Fix typo in comments. 2020-12-06 13:44:57 +09:00
domain.c tomoyo: refactor deprecated strncpy 2023-08-05 19:55:10 +09:00
environ.c
file.c tomoyo: struct path it might get from LSM callers won't have NULL dentry or mnt 2022-08-21 11:50:42 -04:00
gc.c tomoyo: Fix typo in comments. 2020-12-06 13:44:57 +09:00
group.c
Kconfig tomoyo: Update website link 2023-01-13 23:11:38 +09:00
load_policy.c TOMOYO: fix __setup handlers return values 2022-02-24 07:45:07 +09:00
Makefile tomoyo: Omit use of bin2c 2023-01-09 21:46:50 +09:00
memory.c tomoyo: Fix null pointer check 2020-11-27 19:36:11 +09:00
mount.c
network.c tomoyo: don't special case PF_IO_WORKER for PF_KTHREAD 2021-03-28 13:11:29 +09:00
realpath.c tomoyo: struct path it might get from LSM callers won't have NULL dentry or mnt 2022-08-21 11:50:42 -04:00
securityfs_if.c tomoyo: fix doc warnings 2021-06-16 00:01:28 +09:00
tomoyo.c exec: Check __FMODE_EXEC instead of in_execve for LSMs 2024-01-24 11:38:58 -08:00
util.c tomoyo: use hwight16() in tomoyo_domain_quota_is_ok() 2021-12-15 20:13:55 +09:00