Subject: CVE-2024-26622: tomoyo: fix UAF write bug in tomoyo_write_control()

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tomoyo: fix UAF write bug in tomoyo_write_control()

Since tomoyo_write_control() updates head->write_buf when write()
of long lines is requested, we need to fetch head->write_buf after
head->io_sem is held.  Otherwise, concurrent write() requests can
cause use-after-free-write and double-free problems.

The Linux kernel CVE team has assigned CVE-2024-26622 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 3.1 with commit bd03a3e4c9a9 and fixed in 5.10.212 with commit a23ac1788e2c
	Issue introduced in 3.1 with commit bd03a3e4c9a9 and fixed in 5.15.151 with commit 7d930a4da179
	Issue introduced in 3.1 with commit bd03a3e4c9a9 and fixed in 6.1.81 with commit 3bfe04c1273d
	Issue introduced in 3.1 with commit bd03a3e4c9a9 and fixed in 6.6.21 with commit 2caa60507948
	Issue introduced in 3.1 with commit bd03a3e4c9a9 and fixed in 6.7.9 with commit 6edefe1b6c29
	Issue introduced in 3.1 with commit bd03a3e4c9a9 and fixed in 6.8 with commit 2f03fc340cac

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26622
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	security/tomoyo/common.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a23ac1788e2c828c097119e9a3178f0b7e503fee
	https://git.kernel.org/stable/c/7d930a4da17958f869ef679ee0e4a8729337affc
	https://git.kernel.org/stable/c/3bfe04c1273d30b866f4c7c238331ed3b08e5824
	https://git.kernel.org/stable/c/2caa605079488da9601099fbda460cfc1702839f
	https://git.kernel.org/stable/c/6edefe1b6c29a9932f558a898968a9fcbeec5711
	https://git.kernel.org/stable/c/2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815