On Tue, May 12, 2020 at 8:44 AM Paolo Abeni <[email protected]> wrote: > > The cipso and calipso code can set the MLS_CAT attribute on > successful parsing, even if the corresponding catmap has > not been allocated, as per current configuration and external > input. > > Later, selinux code tries to access the catmap if the MLS_CAT flag > is present via netlbl_catmap_getlong(). That may cause null ptr > dereference while processing incoming network traffic. > > Address the issue setting the MLS_CAT flag only if the catmap is > really allocated. Additionally let netlbl_catmap_getlong() cope > with NULL catmap. > > Reported-by: Matthew Sheets <[email protected]> > Fixes: 4b8feff251da ("netlabel: fix the horribly broken catmap functions") > Fixes: ceba1832b1b2 ("calipso: Set the calipso socket label to match the > secattr.") > Signed-off-by: Paolo Abeni <[email protected]> > --- > net/ipv4/cipso_ipv4.c | 6 ++++-- > net/ipv6/calipso.c | 3 ++- > net/netlabel/netlabel_kapi.c | 6 ++++++ > 3 files changed, 12 insertions(+), 3 deletions(-)
Seems reasonable to me, thanks Paolo. Acked-by: Paul Moore <[email protected]> -- paul moore www.paul-moore.com
