Re: [PATCH] smack: fix possible use after frees in task_security() callers

2015-01-21 Thread Casey Schaufler
On 1/13/2015 7:52 AM, Andrey Ryabinin wrote: > We hit use after free on dereferncing pointer to task_smack struct in > smk_of_task() called from smack_task_to_inode(). > > task_security() macro uses task_cred_xxx() to get pointer to the task_smack. > task_cred_xxx() could be used only for

Re: [PATCH] smack: fix possible use after frees in task_security() callers

2015-01-21 Thread Casey Schaufler
On 1/13/2015 7:52 AM, Andrey Ryabinin wrote: We hit use after free on dereferncing pointer to task_smack struct in smk_of_task() called from smack_task_to_inode(). task_security() macro uses task_cred_xxx() to get pointer to the task_smack. task_cred_xxx() could be used only for non-pointer

Re: [PATCH] smack: fix possible use after frees in task_security() callers

2015-01-13 Thread Casey Schaufler
On 1/13/2015 7:52 AM, Andrey Ryabinin wrote: > We hit use after free on dereferncing pointer to task_smack struct in > smk_of_task() called from smack_task_to_inode(). > > task_security() macro uses task_cred_xxx() to get pointer to the task_smack. > task_cred_xxx() could be used only for

[PATCH] smack: fix possible use after frees in task_security() callers

2015-01-13 Thread Andrey Ryabinin
We hit use after free on dereferncing pointer to task_smack struct in smk_of_task() called from smack_task_to_inode(). task_security() macro uses task_cred_xxx() to get pointer to the task_smack. task_cred_xxx() could be used only for non-pointer members of task's credentials. It cannot be used

Re: [PATCH] smack: fix possible use after frees in task_security() callers

2015-01-13 Thread Casey Schaufler
On 1/13/2015 7:52 AM, Andrey Ryabinin wrote: We hit use after free on dereferncing pointer to task_smack struct in smk_of_task() called from smack_task_to_inode(). task_security() macro uses task_cred_xxx() to get pointer to the task_smack. task_cred_xxx() could be used only for non-pointer

[PATCH] smack: fix possible use after frees in task_security() callers

2015-01-13 Thread Andrey Ryabinin
We hit use after free on dereferncing pointer to task_smack struct in smk_of_task() called from smack_task_to_inode(). task_security() macro uses task_cred_xxx() to get pointer to the task_smack. task_cred_xxx() could be used only for non-pointer members of task's credentials. It cannot be used