[PATCH] selinux: fix potential use-after-free in sel_netif_flush()

[mdshahid03]

From: Mohammad Shahid <mdshahid03@xxxxxxxxx>

sel_netif_flush() use list_for_each_entry() while deleting
entries from the network interface list.

Use list_for_each_entry_safe() to save the next entry before
deleting the current one and avoid accessing freed memory.

The issue is reported by smatch as potential use-after-free.

Signed-off-by: Mohammad Shahid <mdshahid03@xxxxxxxxx>
---
 security/selinux/netif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index fa6d24a37c39..d5e258fd52aa 100644
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -242,11 +242,11 @@ static void sel_netif_kill(const struct net *ns, int ifindex)
 void sel_netif_flush(void)
 {
 	int idx;
-	struct sel_netif *netif;
+	struct sel_netif *netif, *tmp;
 
 	spin_lock_bh(&sel_netif_lock);
 	for (idx = 0; idx < SEL_NETIF_HASH_SIZE; idx++)
-		list_for_each_entry(netif, &sel_netif_hash[idx], list)
+		list_for_each_entry_safe(netif, tmp, &sel_netif_hash[idx], list)
 			sel_netif_destroy(netif);
 	spin_unlock_bh(&sel_netif_lock);
 }
-- 
2.43.0