[PATCH] selinux: fix potential use-after-free in sel_netif_flush()

[PATCH] selinux: fix potential use-after-free in sel_netif_flush()

[mdshahid03]

From: Mohammad Shahid <mdshahid03@gmail.com>

sel_netif_flush() use list_for_each_entry() while deleting
entries from the network interface list.

Use list_for_each_entry_safe() to save the next entry before
deleting the current one and avoid accessing freed memory.

The issue is reported by smatch as potential use-after-free.

Signed-off-by: Mohammad Shahid <mdshahid03@gmail.com>
---
 security/selinux/netif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index fa6d24a37c39..d5e258fd52aa 100644
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -242,11 +242,11 @@ static void sel_netif_kill(const struct net *ns, int ifindex)
 void sel_netif_flush(void)
 {
 	int idx;
-	struct sel_netif *netif;
+	struct sel_netif *netif, *tmp;
 
 	spin_lock_bh(&sel_netif_lock);
 	for (idx = 0; idx < SEL_NETIF_HASH_SIZE; idx++)
-		list_for_each_entry(netif, &sel_netif_hash[idx], list)
+		list_for_each_entry_safe(netif, tmp, &sel_netif_hash[idx], list)
 			sel_netif_destroy(netif);
 	spin_unlock_bh(&sel_netif_lock);
 }
-- 
2.43.0

Re: [PATCH] selinux: fix potential use-after-free in sel_netif_flush()

[Stephen Smalley]

On Mon, Nov 9, 2026 at 12:00 PM <mdshahid03@gmail.com> wrote:
>
> From: Mohammad Shahid <mdshahid03@gmail.com>
>
> sel_netif_flush() use list_for_each_entry() while deleting
> entries from the network interface list.
>
> Use list_for_each_entry_safe() to save the next entry before
> deleting the current one and avoid accessing freed memory.
>
> The issue is reported by smatch as potential use-after-free.
>
> Signed-off-by: Mohammad Shahid <mdshahid03@gmail.com>

This isn't actually necessary AFAICT - sel_netif_destroy() preserves
the forward link with list_del_rcu() and defers reclamation with
kfree_rcu(). The loop holds spin_lock_bh() throughout, so the current
entry remains alive through the iterator increment.