lkml.org 
[lkml]   [2020]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 097/149] Smack: prevent underflow in smk_set_cipso()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 42a2df3e829f3c5562090391b33714b2e2e5ad4a ]

    We have an upper bound on "maplevel" but forgot to check for negative
    values.

    Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/smack/smackfs.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
    index 2e2ef3a525ecb..df082648eb0aa 100644
    --- a/security/smack/smackfs.c
    +++ b/security/smack/smackfs.c
    @@ -918,7 +918,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
    }

    ret = sscanf(rule, "%d", &maplevel);
    - if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
    + if (ret != 1 || maplevel < 0 || maplevel > SMACK_CIPSO_MAXLEVEL)
    goto out;

    rule += SMK_DIGITLEN;
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-08-20 12:30    [W:3.436 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site