Re: [PATCH] selinux: fix potential use-after-free in sel_netif_flush()

[Stephen Smalley]

On Mon, Nov 9, 2026 at 12:00 PM <mdshahid03@xxxxxxxxx> wrote:
>
> From: Mohammad Shahid <mdshahid03@xxxxxxxxx>
>
> sel_netif_flush() use list_for_each_entry() while deleting
> entries from the network interface list.
>
> Use list_for_each_entry_safe() to save the next entry before
> deleting the current one and avoid accessing freed memory.
>
> The issue is reported by smatch as potential use-after-free.
>
> Signed-off-by: Mohammad Shahid <mdshahid03@xxxxxxxxx>

This isn't actually necessary AFAICT - sel_netif_destroy() preserves
the forward link with list_del_rcu() and defers reclamation with
kfree_rcu(). The loop holds spin_lock_bh() throughout, so the current
entry remains alive through the iterator increment.