2f03fc340c
Since tomoyo_write_control() updates head->write_buf when write()
of long lines is requested, we need to fetch head->write_buf after
head->io_sem is held. Otherwise, concurrent write() requests can
cause use-after-free-write and double-free problems.
Reported-by: Sam Sun <samsun1006219@gmail.com>
Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji8g@mail.gmail.com
Fixes:
|
||
---|---|---|
.. | ||
policy | ||
.gitignore | ||
Kconfig | ||
Makefile | ||
audit.c | ||
common.c | ||
common.h | ||
condition.c | ||
domain.c | ||
environ.c | ||
file.c | ||
gc.c | ||
group.c | ||
load_policy.c | ||
memory.c | ||
mount.c | ||
network.c | ||
realpath.c | ||
securityfs_if.c | ||
tomoyo.c | ||
util.c |