]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
dccp: Call security_inet_conn_request() after setting IPv4 addresses.
authorKuniyuki Iwashima <kuniyu@amazon.com>
Mon, 30 Oct 2023 20:10:41 +0000 (13:10 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 20 Nov 2023 09:30:15 +0000 (10:30 +0100)
commit3af0af2f98f3f5df22eecc0db8e6f93991f2343b
treeb212906e16166fd64a97d239e41a270dafe96dc7
parentafa49774d8123b4af3a092dc4840c874e568f92c
dccp: Call security_inet_conn_request() after setting IPv4 addresses.

[ Upstream commit fa2df45af13091f76b89adb84a28f13818d5d631 ]

Initially, commit 4237c75c0a35 ("[MLSXFRM]: Auto-labeling of child
sockets") introduced security_inet_conn_request() in some functions
where reqsk is allocated.  The hook is added just after the allocation,
so reqsk's IPv4 remote address was not initialised then.

However, SELinux/Smack started to read it in netlbl_req_setattr()
after the cited commits.

This bug was partially fixed by commit 284904aa7946 ("lsm: Relocate
the IPv4 security_inet_conn_request() hooks").

This patch fixes the last bug in DCCPv4.

Fixes: 389fb800ac8b ("netlabel: Label incoming TCP connections correctly in SELinux")
Fixes: 07feee8f812f ("netlabel: Cleanup the Smack/NetLabel code to fix incoming TCP connections")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/dccp/ipv4.c