Patch "smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     smackfs-use-rcu_assign_pointer-to-ensure-safe-assign.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b93b0d7f33b4ae288d470c4f907209b91edc96de
Author: Jiawei Ye <jiawei.ye@xxxxxxxxxxx>
Date:   Mon Sep 2 08:47:26 2024 +0000

    smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
    
    [ Upstream commit 2749749afa071f8a0e405605de9da615e771a7ce ]
    
    In the `smk_set_cipso` function, the `skp->smk_netlabel.attr.mls.cat`
    field is directly assigned to a new value without using the appropriate
    RCU pointer assignment functions. According to RCU usage rules, this is
    illegal and can lead to unpredictable behavior, including data
    inconsistencies and impossible-to-diagnose memory corruption issues.
    
    This possible bug was identified using a static analysis tool developed
    by myself, specifically designed to detect RCU-related issues.
    
    To address this, the assignment is now done using rcu_assign_pointer(),
    which ensures that the pointer assignment is done safely, with the
    necessary memory barriers and synchronization. This change prevents
    potential RCU dereference issues by ensuring that the `cat` field is
    safely updated while still adhering to RCU's requirements.
    
    Fixes: 0817534ff9ea ("smackfs: Fix use-after-free in netlbl_catmap_walk()")
    Signed-off-by: Jiawei Ye <jiawei.ye@xxxxxxxxxxx>
    Signed-off-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index da7db9e22ce7c..d955f3dcb3a5e 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -921,7 +921,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
 	rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);
 	if (rc >= 0) {
 		old_cat = skp->smk_netlabel.attr.mls.cat;
-		skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
+		rcu_assign_pointer(skp->smk_netlabel.attr.mls.cat, ncats.attr.mls.cat);
 		skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
 		synchronize_rcu();
 		netlbl_catmap_free(old_cat);