diff options
| author | Tetsuo Handa <[email protected]> | 2024-03-01 22:04:06 +0900 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2024-03-01 11:14:00 -0800 |
| commit | 2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815 (patch) | |
| tree | 6793ee2fd5d6cf14bbfb537e68d3f832eb7223e5 /scripts/gdb/linux/mm.py | |
| parent | 87adedeba51a822533649b143232418b9e26d08b (diff) | |
tomoyo: fix UAF write bug in tomoyo_write_control()
Since tomoyo_write_control() updates head->write_buf when write()
of long lines is requested, we need to fetch head->write_buf after
head->io_sem is held. Otherwise, concurrent write() requests can
cause use-after-free-write and double-free problems.
Reported-by: Sam Sun <[email protected]>
Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji8g@mail.gmail.com
Fixes: bd03a3e4c9a9 ("TOMOYO: Add policy namespace support.")
Cc: <[email protected]> # Linux 3.1+
Signed-off-by: Tetsuo Handa <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Diffstat (limited to 'scripts/gdb/linux/mm.py')
0 files changed, 0 insertions, 0 deletions