lkml.org 
[lkml]   [2019]   [Jul]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.2 180/215] selinux: check sidtab limit before adding a new entry
    Date
    From: Ondrej Mosnacek <omosnace@redhat.com>

    commit acbc372e6109c803cbee4733769d02008381740f upstream.

    We need to error out when trying to add an entry above SIDTAB_MAX in
    sidtab_reverse_lookup() to avoid overflow on the odd chance that this
    happens.

    Cc: stable@vger.kernel.org
    Fixes: ee1a84fdfeed ("selinux: overhaul sidtab to fix bug and improve performance")
    Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    security/selinux/ss/sidtab.c | 5 +++++
    1 file changed, 5 insertions(+)

    --- a/security/selinux/ss/sidtab.c
    +++ b/security/selinux/ss/sidtab.c
    @@ -286,6 +286,11 @@ static int sidtab_reverse_lookup(struct
    ++count;
    }

    + /* bail out if we already reached max entries */
    + rc = -EOVERFLOW;
    + if (count >= SIDTAB_MAX)
    + goto out_unlock;
    +
    /* insert context into new entry */
    rc = -ENOMEM;
    dst = sidtab_do_lookup(s, count, 1);

    \
     
     \ /
      Last update: 2019-07-29 21:58    [W:5.089 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site