| Date | Fri, 13 Mar 2009 18:10:43 -0700 | From | Greg KH <> | Subject | [patch 066/114] selinux: Fix a panic in selinux_netlbl_inode_permission() |
| |
2.6.28-stable review patch. If anyone has any objections, please let us know.
------------------
From: Paul Moore <paul.moore@hp.com>
commit d7f59dc4642ce2fc7b79fcd4ec02ffce7f21eb02 upstream.
Rick McNeal from LSI identified a panic in selinux_netlbl_inode_permission() caused by a certain sequence of SUNRPC operations. The problem appears to be due to the lack of NULL pointer checking in the function; this patch adds the pointer checks so the function will exit safely in the cases where the socket is not completely initialized.
Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org> Cc: Chuck Ebbert <cebbert@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- security/selinux/netlabel.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
--- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -386,11 +386,12 @@ int selinux_netlbl_inode_permission(stru if (!S_ISSOCK(inode->i_mode) || ((mask & (MAY_WRITE | MAY_APPEND)) == 0)) return 0; - sock = SOCKET_I(inode); sk = sock->sk; + if (sk == NULL) + return 0; sksec = sk->sk_security; - if (sksec->nlbl_state != NLBL_REQUIRE) + if (sksec == NULL || sksec->nlbl_state != NLBL_REQUIRE) return 0; local_bh_disable();
|