mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-22 07:53:11 -05:00
Code Activity

net: corrections for security_secid_to_secctx returns

Browse source 
security_secid_to_secctx() returns the size of the new context,
whereas previous versions provided that via a pointer parameter.
Correct the type of the value returned in nfqnl_get_sk_secctx()
and the check for error in netlbl_unlhsh_add(). Add an error
check.

Fixes: 2d470c7781 ("lsm: replace context+len with lsm_context")
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Casey Schaufler 2024-12-20 14:02:46 -08:00 committed by Paul Moore
parent b00083aed4
commit 3b44cd0998
2 changed files with 10 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
net/netfilter/nfnetlink_queue.c
View file

@ -470,9 +470,9 @@ static int nfqnl_put_sk_classid(struct sk_buff *skb, struct sock *sk)
return 0; return 0;
} }
static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, struct lsm_context *ctx) static int nfqnl_get_sk_secctx(struct sk_buff *skb, struct lsm_context *ctx)
{ {
u32 seclen = 0; int seclen = 0;
#if IS_ENABLED(CONFIG_NETWORK_SECMARK) #if IS_ENABLED(CONFIG_NETWORK_SECMARK)
if (!skb || !sk_fullsock(skb->sk)) if (!skb || !sk_fullsock(skb->sk))
@ -568,7 +568,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
const struct nfnl_ct_hook *nfnl_ct; const struct nfnl_ct_hook *nfnl_ct;
bool csum_verify; bool csum_verify;
struct lsm_context ctx; struct lsm_context ctx;
u32 seclen = 0; int seclen = 0;
ktime_t tstamp; ktime_t tstamp;
size = nlmsg_total_size(sizeof(struct nfgenmsg)) size = nlmsg_total_size(sizeof(struct nfgenmsg))
@ -643,7 +643,9 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) { if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) {
seclen = nfqnl_get_sk_secctx(entskb, &ctx); seclen = nfqnl_get_sk_secctx(entskb, &ctx);
if (seclen >= 0) if (seclen < 0)
return NULL;
if (seclen)
size += nla_total_size(seclen); size += nla_total_size(seclen);
} }
@ -782,7 +784,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
if (nfqnl_put_sk_classid(skb, entskb->sk) < 0) if (nfqnl_put_sk_classid(skb, entskb->sk) < 0)
goto nla_put_failure; goto nla_put_failure;
if (seclen && nla_put(skb, NFQA_SECCTX, ctx.len, ctx.context)) if (seclen > 0 && nla_put(skb, NFQA_SECCTX, ctx.len, ctx.context))
goto nla_put_failure; goto nla_put_failure;
if (ct && nfnl_ct->build(skb, ct, ctinfo, NFQA_CT, NFQA_CT_INFO) < 0) if (ct && nfnl_ct->build(skb, ct, ctinfo, NFQA_CT, NFQA_CT_INFO) < 0)

6
net/netlabel/netlabel_unlabeled.c
View file

@ -437,7 +437,7 @@ int netlbl_unlhsh_add(struct net *net,
unlhsh_add_return: unlhsh_add_return:
rcu_read_unlock(); rcu_read_unlock();
if (audit_buf != NULL) { if (audit_buf != NULL) {
if (security_secid_to_secctx(secid, &ctx) == 0) { if (security_secid_to_secctx(secid, &ctx) >= 0) {
audit_log_format(audit_buf, " sec_obj=%s", ctx.context); audit_log_format(audit_buf, " sec_obj=%s", ctx.context);
security_release_secctx(&ctx); security_release_secctx(&ctx);
} }
@ -490,7 +490,7 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
addr->s_addr, mask->s_addr); addr->s_addr, mask->s_addr);
dev_put(dev); dev_put(dev);
if (entry != NULL && if (entry != NULL &&
security_secid_to_secctx(entry->secid, &ctx) == 0) { security_secid_to_secctx(entry->secid, &ctx) >= 0) {
audit_log_format(audit_buf, " sec_obj=%s", ctx.context); audit_log_format(audit_buf, " sec_obj=%s", ctx.context);
security_release_secctx(&ctx); security_release_secctx(&ctx);
} }
@ -548,7 +548,7 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
addr, mask); addr, mask);
dev_put(dev); dev_put(dev);
if (entry != NULL && if (entry != NULL &&
security_secid_to_secctx(entry->secid, &ctx) == 0) { security_secid_to_secctx(entry->secid, &ctx) >= 0) {
audit_log_format(audit_buf, " sec_obj=%s", ctx.context); audit_log_format(audit_buf, " sec_obj=%s", ctx.context);
security_release_secctx(&ctx); security_release_secctx(&ctx);
} }