The synchronization between security_shm_xx and security_shm_free was modified without updating security/*.c.

This created an use-after-free race with security/selinux/hooks.c

Affected: current head

Details:
Assume a preemptible kernel that is preempted just after
> isec = ipc_perms->security;
in ipc_has_perm (called from e.g. selinux_shm_at()).
The call happens just with rcu_read_lock().

Now the other thread calls whatever operations are necessary to end up in sem_destroy(), which calls security_shm_free().
This ends up doing kfree(isec).