DigiGoon/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

selinux: improve error checking in sel_write_load()

Browse source 
[ Upstream commit 42c773238037c90b3302bf37a57ae3b5c3f6004a ]

Move our existing input sanity checking to the top of sel_write_load()
and add a check to ensure the buffer size is non-zero.

Move a local variable initialization from the declaration to before it
is used.

Minor style adjustments.

Reported-by: Sam Sun <samsun1006219@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
[cascardo: keep fsi initialization at its declaration point as it is used earlier]
[cascardo: keep check for 64MiB size limit]
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Paul Moore 2024-10-25 11:21:18 -03:00 • committed by Greg Kroah-Hartman
parent 31a38a908c
commit 5121ac6723
1 changed files with 17 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
security/selinux/selinuxfs.c
View file

@ -535,6 +535,16 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
ssize_t length;
void *data = NULL;
/* no partial writes */
if (*ppos)
return -EINVAL;
/* no empty policies */
if (!count)
return -EINVAL;
if (count > 64 * 1024 * 1024)
return -EFBIG;
mutex_lock(&fsi->mutex);
length = avc_has_perm(&selinux_state,
@ -543,23 +553,15 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
if (length)
goto out;
/* No partial writes. */
length = -EINVAL;
if (*ppos != 0)
goto out;
length = -EFBIG;
if (count > 64 * 1024 * 1024)
goto out;
length = -ENOMEM;
data = vmalloc(count);
if (!data)
if (!data) {
length = -ENOMEM;
goto out;
length = -EFAULT;
if (copy_from_user(data, buf, count) != 0)
}
if (copy_from_user(data, buf, count) != 0) {
length = -EFAULT;
goto out;
}
length = security_load_policy(fsi->state, data, count);
if (length) {
@ -578,6 +580,7 @@ out1:
"auid=%u ses=%u lsm=selinux res=1",
from_kuid(&init_user_ns, audit_get_loginuid(current)),
audit_get_sessionid(current));
out:
mutex_unlock(&fsi->mutex);
vfree(data);