Skip to content

Commit

Permalink
netlabel: cope with NULL catmap
Browse files Browse the repository at this point in the history
The cipso and calipso code can set the MLS_CAT attribute on
successful parsing, even if the corresponding catmap has
not been allocated, as per current configuration and external
input.

Later, selinux code tries to access the catmap if the MLS_CAT flag
is present via netlbl_catmap_getlong(). That may cause null ptr
dereference while processing incoming network traffic.

Address the issue setting the MLS_CAT flag only if the catmap is
really allocated. Additionally let netlbl_catmap_getlong() cope
with NULL catmap.

Reported-by: Matthew Sheets <[email protected]>
Fixes: 4b8feff ("netlabel: fix the horribly broken catmap functions")
Fixes: ceba183 ("calipso: Set the calipso socket label to match the secattr.")
Signed-off-by: Paolo Abeni <[email protected]>
Acked-by: Paul Moore <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Paolo Abeni authored and davem330 committed May 13, 2020
1 parent 24adbc1 commit eead1c2
Showing 3 changed files with 12 additions and 3 deletions.
6 changes: 4 additions & 2 deletions net/ipv4/cipso_ipv4.c
Original file line number Diff line number Diff line change
@@ -1258,7 +1258,8 @@ static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
return ret_val;
}

secattr->flags |= NETLBL_SECATTR_MLS_CAT;
if (secattr->attr.mls.cat)
secattr->flags |= NETLBL_SECATTR_MLS_CAT;
}

return 0;
@@ -1439,7 +1440,8 @@ static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
return ret_val;
}

secattr->flags |= NETLBL_SECATTR_MLS_CAT;
if (secattr->attr.mls.cat)
secattr->flags |= NETLBL_SECATTR_MLS_CAT;
}

return 0;
3 changes: 2 additions & 1 deletion net/ipv6/calipso.c
Original file line number Diff line number Diff line change
@@ -1047,7 +1047,8 @@ static int calipso_opt_getattr(const unsigned char *calipso,
goto getattr_return;
}

secattr->flags |= NETLBL_SECATTR_MLS_CAT;
if (secattr->attr.mls.cat)
secattr->flags |= NETLBL_SECATTR_MLS_CAT;
}

secattr->type = NETLBL_NLTYPE_CALIPSO;
6 changes: 6 additions & 0 deletions net/netlabel/netlabel_kapi.c
Original file line number Diff line number Diff line change
@@ -734,6 +734,12 @@ int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap,
if ((off & (BITS_PER_LONG - 1)) != 0)
return -EINVAL;

/* a null catmap is equivalent to an empty one */
if (!catmap) {
*offset = (u32)-1;
return 0;
}

if (off < catmap->startbit) {
off = catmap->startbit;
*offset = off;

0 comments on commit eead1c2

Please sign in to comment.