tomoyo: fix UAF write bug in tomoyo_write_control()

stable inclusion
from stable-v5.10.212
commit a23ac1788e2c828c097119e9a3178f0b7e503fee
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95LPF
CVE: CVE-2024-26622

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a23ac1788e2c828c097119e9a3178f0b7e503fee



--------------------------------

commit 2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815 upstream.

Since tomoyo_write_control() updates head->write_buf when write()
of long lines is requested, we need to fetch head->write_buf after
head->io_sem is held.  Otherwise, concurrent write() requests can
cause use-after-free-write and double-free problems.

Reported-by: Sam Sun <samsun1006219@gmail.com>
Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji8g@mail.gmail.com


Fixes: bd03a3e4 ("TOMOYO: Add policy namespace support.")
Cc:  <stable@vger.kernel.org> # Linux 3.1+
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Conflicts:
	security/tomoyo/common.c

Signed-off-by: Felix Fu <fuzhen5@huawei.com>