netlabel: cope with NULL catmap

[ Upstream commit eead1c2ea2509fd754c6da893a94f0e69e83ebe4 ]

The cipso and calipso code can set the MLS_CAT attribute on
successful parsing, even if the corresponding catmap has
not been allocated, as per current configuration and external
input.

Later, selinux code tries to access the catmap if the MLS_CAT flag
is present via netlbl_catmap_getlong(). That may cause null ptr
dereference while processing incoming network traffic.

Address the issue setting the MLS_CAT flag only if the catmap is
really allocated. Additionally let netlbl_catmap_getlong() cope
with NULL catmap.

Reported-by: Matthew Sheets <matthew.sheets@gd-ms.com>
Fixes: 4b8feff251da ("netlabel: fix the horribly broken catmap functions")
Fixes: ceba1832b1b2 ("calipso: Set the calipso socket label to match the secattr.")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 0a6f72763bebed5be0d012cb66f69a1973c33017..71409928763b0adfccadd4ec64ad432b9d655f5a 100644 (file)
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1272,7 +1272,8 @@ static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
                        return ret_val;
                }
 
-               secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+               if (secattr->attr.mls.cat)
+                       secattr->flags |= NETLBL_SECATTR_MLS_CAT;
        }
 
        return 0;
@@ -1453,7 +1454,8 @@ static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
                        return ret_val;
                }
 
-               secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+               if (secattr->attr.mls.cat)
+                       secattr->flags |= NETLBL_SECATTR_MLS_CAT;
        }
 
        return 0;

diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index 9742abf5ac26ac5b46a9f6e673778163a1cc223e..b206415bbde748b2e3ba79a3eacc5649c641788e 100644 (file)
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -1061,7 +1061,8 @@ static int calipso_opt_getattr(const unsigned char *calipso,
                        goto getattr_return;
                }
 
-               secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+               if (secattr->attr.mls.cat)
+                       secattr->flags |= NETLBL_SECATTR_MLS_CAT;
        }
 
        secattr->type = NETLBL_NLTYPE_CALIPSO;

diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index cb9d1d1210cb77418ad7823aed1d386bd3dc6c82..d0cfdff04993af150c15b0815223d38e6e6fad2b 100644 (file)
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -748,6 +748,12 @@ int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap,
        if ((off & (BITS_PER_LONG - 1)) != 0)
                return -EINVAL;
 
+       /* a null catmap is equivalent to an empty one */
+       if (!catmap) {
+               *offset = (u32)-1;
+               return 0;
+       }
+
        if (off < catmap->startbit) {
                off = catmap->startbit;
                *offset = off;