{"push_id":607362432,"size":1,"distinct_size":1,"ref":"refs/heads/cm-12.0","head":"3f7c9154ad66d88d4ba17d2dd4bc2147adabf000","before":"383536f50c3b461ca864d067525122d74ba964e8","commits":[{"sha":"3f7c9154ad66d88d4ba17d2dd4bc2147adabf000","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"selinux: fix inode security list corruption\n\ncommit 923190d32de4428afbea5e5773be86bea60a9925 upstream.\n\nsb_finish_set_opts() can race with inode_free_security()\nwhen initializing inode security structures for inodes\ncreated prior to initial policy load or by the filesystem\nduring ->mount().   This appears to have always been\na possible race, but commit 3dc91d4 (\"SELinux:  Fix possible\nNULL pointer dereference in selinux_inode_permission()\")\nmade it more evident by immediately reusing the unioned\nlist/rcu element  of the inode security structure for call_rcu()\nupon an inode_free_security().  But the underlying issue\nwas already present before that commit as a possible use-after-free\nof isec.\n\nShivnandan Kumar reported the list corruption and proposed\na patch to split the list and rcu elements out of the union\nas separate fields of the inode_security_struct so that setting\nthe rcu element would not affect the list element.  However,\nthis would merely hide the issue and not truly fix the code.\n\nThis patch instead moves up the deletion of the list entry\nprior to dropping the sbsec->isec_lock initially.  Then,\nif the inode is dropped subsequently, there will be no further\nreferences to the isec.\n\nChange-Id: Iac9264851e98933deabedaa9c4ead434669a07a8\nReported-by: Shivnandan Kumar <shivnandan.k@samsung.com>\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/CyanogenLGE/lge-kernel-lproj/commits/3f7c9154ad66d88d4ba17d2dd4bc2147adabf000"}]}