Commit b2b8438e authored Jul 23, 2020 by Dan Carpenter Committed by Greg Kroah-Hartman Aug 19, 2020

Smack: prevent underflow in smk_set_cipso()



[ Upstream commit 42a2df3e829f3c5562090391b33714b2e2e5ad4a ]

We have an upper bound on "maplevel" but forgot to check for negative
values.

Fixes: e114e473 ("Smack: Simplified Mandatory Access Control Kernel")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 67499265

security/smack/smackfs.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -884,7 +884,7 @@ static ssize_t smk_set_cipso(struct file file, const char __user buf,
		}

		ret = sscanf(rule, "%d", &maplevel);
		if (ret != 1 \|\| maplevel > SMACK_CIPSO_MAXLEVEL)
		if (ret != 1 \|\| maplevel < 0 \|\| maplevel > SMACK_CIPSO_MAXLEVEL)
		goto out;

		rule += SMK_DIGITLEN;