smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
authorTetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Tue, 19 Oct 2021 11:27:26 +0000 (20:27 +0900)
committerCasey Schaufler <casey@schaufler-ca.com>
Fri, 22 Oct 2021 15:46:53 +0000 (08:46 -0700)
commit0934ad42bb2c5df90a1b9de690f93de735b622fe
tree23aec577a649388082a6b9788f4c3f1f3d18e478
parentf91488ee15bd3cac467e2d6a361fc2d34d1052ae
smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi

syzbot is reporting UAF at cipso_v4_doi_search() [1], for smk_cipso_doi()
is calling kfree() without removing from the cipso_v4_doi_list list after
netlbl_cfg_cipsov4_map_add() returned an error. We need to use
netlbl_cfg_cipsov4_del() in order to remove from the list and wait for
RCU grace period before kfree().

Link: https://syzkaller.appspot.com/bug?extid=93dba5b91f0fed312cbd
Reported-by: syzbot <syzbot+93dba5b91f0fed312cbd@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 6c2e8ac0953fccdd ("netlabel: Update kernel configuration API")
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
security/smack/smackfs.c