selinux: unify OOM handling in network hashtables

For network objects, like interfaces, nodes, port and InfiniBands, the
object to SID lookup is cached in hashtables.  OOM during such hashtable
additions of new objects is considered non-fatal and the computed SID is
simply returned without adding the compute result into the hash table.

Actually ignore OOM in the InfiniBand code, despite the comment already
suggesting to do so.  This reverts commit c350f8bea271 ("selinux: Fix
error return code in sel_ib_pkey_sid_slow()").

Add comments in the other places.

Use kmalloc() instead of kzalloc(), since all members are initialized on
success and the data is only used in internbal hash tables, so no risk
of information leakage to userspace.

Fixes: c350f8bea271 ("selinux: Fix error return code in sel_ib_pkey_sid_slow()")
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/ibpkey.c b/security/selinux/ibpkey.c
index 94f3eef22bad712e217efcceb716410cf3e21c4a..470481cfe0e81142e5d0afa28c11b5b91718fb5a 100644 (file)
--- a/security/selinux/ibpkey.c
+++ b/security/selinux/ibpkey.c
@@ -130,7 +130,7 @@ static int sel_ib_pkey_sid_slow(u64 subnet_prefix, u16 pkey_num, u32 *sid)
 {
        int ret;
        struct sel_ib_pkey *pkey;
-       struct sel_ib_pkey *new = NULL;
+       struct sel_ib_pkey *new;
        unsigned long flags;
 
        spin_lock_irqsave(&sel_ib_pkey_lock, flags);
@@ -146,12 +146,11 @@ static int sel_ib_pkey_sid_slow(u64 subnet_prefix, u16 pkey_num, u32 *sid)
        if (ret)
                goto out;
 
-       /* If this memory allocation fails still return 0. The SID
-        * is valid, it just won't be added to the cache.
-        */
-       new = kzalloc(sizeof(*new), GFP_ATOMIC);
+       new = kmalloc(sizeof(*new), GFP_ATOMIC);
        if (!new) {
-               ret = -ENOMEM;
+               /* If this memory allocation fails still return 0. The SID
+                * is valid, it just won't be added to the cache.
+                */
                goto out;
        }
 

diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index 43a0d3594b725de19132a2d8f76b980030181fc5..78afbecdbe57c80e5d86c618269b57e87a8cab4f 100644 (file)
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -156,7 +156,11 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
        ret = security_netif_sid(dev->name, sid);
        if (ret != 0)
                goto out;
-       new = kzalloc(sizeof(*new), GFP_ATOMIC);
+
+       /* If this memory allocation fails still return 0. The SID
+        * is valid, it just won't be added to the cache.
+        */
+       new = kmalloc(sizeof(*new), GFP_ATOMIC);
        if (new) {
                new->nsec.ns = ns;
                new->nsec.ifindex = ifindex;

diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index 8bb456d80dd54025955de65a24b69013b7eab8c9..5d0ed08d46e5ea81ff191d22dff9974e4824add4 100644 (file)
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -201,7 +201,10 @@ static int sel_netnode_sid_slow(const void *addr, u16 family, u32 *sid)
                return 0;
        }
 
-       new = kzalloc(sizeof(*new), GFP_ATOMIC);
+       /* If this memory allocation fails still return 0. The SID
+        * is valid, it just won't be added to the cache.
+        */
+       new = kmalloc(sizeof(*new), GFP_ATOMIC);
        switch (family) {
        case PF_INET:
                ret = security_node_sid(PF_INET,

diff --git a/security/selinux/netport.c b/security/selinux/netport.c
index 7d2207384d401a1f39ff1690f0adb557c4ea34e3..09ef75a18d827af7727aff835de7c3ca2a310b18 100644 (file)
--- a/security/selinux/netport.c
+++ b/security/selinux/netport.c
@@ -151,7 +151,11 @@ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid)
        ret = security_port_sid(protocol, pnum, sid);
        if (ret != 0)
                goto out;
-       new = kzalloc(sizeof(*new), GFP_ATOMIC);
+
+       /* If this memory allocation fails still return 0. The SID
+        * is valid, it just won't be added to the cache.
+        */
+       new = kmalloc(sizeof(*new), GFP_ATOMIC);
        if (new) {
                new->psec.port = pnum;
                new->psec.protocol = protocol;