The synchronization between security_msg_xx and security_msg_free was modified without updating security/*.c.

This created an use-after-free race with security/selinux/hooks.c

Affected: 3.0.11, current head

Details:
Assume a preemptible kernel that is preempted just after
> isec = msq->q_perm.security;
in selinux_msg_queue_msgrcv.
The call happens just with rcu_read_lock().

Now the other thread calls whatever operations are necessary to end up in msg_freeque(), which calls security_msg_queue_free().
This ends up doing kfree(isec).