From: Casey Schaufler Date: Wed, 23 Oct 2024 21:21:58 +0000 (-0700) Subject: lsm: secctx provider check on release X-Git-Tag: v6.14-rc1~166^2~10 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a4626e978677e3d3e816fdc217d8416c8b9462ae;p=thirdparty%2Fkernel%2Fstable.git lsm: secctx provider check on release Verify that the LSM releasing the secctx is the LSM that allocated it. This was not necessary when only one LSM could create a secctx, but once there can be more than one it is. Signed-off-by: Casey Schaufler [PM: subject tweak] Signed-off-by: Paul Moore --- diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c index b08969ec34b75..28caf66b90335 100644 --- a/security/apparmor/secid.c +++ b/security/apparmor/secid.c @@ -108,14 +108,11 @@ int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) void apparmor_release_secctx(struct lsm_context *cp) { - /* - * stacking scaffolding: - * When it is possible for more than one LSM to provide a - * release hook, do this check: - * if (cp->id == LSM_ID_APPARMOR || cp->id == LSM_ID_UNDEF) - */ - - kfree(cp->context); + if (cp->id == LSM_ID_APPARMOR) { + kfree(cp->context); + cp->context = NULL; + cp->id = LSM_ID_UNDEF; + } } /** diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 4f8d37ae769ae..a2e72f1212a3a 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6672,14 +6672,11 @@ static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) static void selinux_release_secctx(struct lsm_context *cp) { - /* - * stacking scaffolding: - * When it is possible for more than one LSM to provide a - * release hook, do this check: - * if (cp->id == LSM_ID_SELINUX || cp->id == LSM_ID_UNDEF) - */ - - kfree(cp->context); + if (cp->id == LSM_ID_SELINUX) { + kfree(cp->context); + cp->context = NULL; + cp->id = LSM_ID_UNDEF; + } } static void selinux_inode_invalidate_secctx(struct inode *inode)