Commit 70c64486 authored Jul 23, 2019 by Ondrej Mosnacek Committed by Alistair Delva Jan 08, 2020

UPSTREAM: selinux: check sidtab limit before adding a new entry



We need to error out when trying to add an entry above SIDTAB_MAX in
sidtab_reverse_lookup() to avoid overflow on the odd chance that this
happens.

Cc: stable@vger.kernel.org
Fixes: ee1a84fdfeed ("selinux: overhaul sidtab to fix bug and improve performance")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Paul Moore <paul@paul-moore.com>

(cherry picked from commit acbc372e6109c803cbee4733769d02008381740f)
Change-Id: I88e6b5b1626c901e41ecbf1dfdded6f4e7301332
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>

parent 081e555d

security/selinux/ss/sidtab.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -286,6 +286,11 @@ static int sidtab_reverse_lookup(struct sidtab s, struct context context,
		++count;
		}

		/* bail out if we already reached max entries */
		rc = -EOVERFLOW;
		if (count >= SIDTAB_MAX)
		goto out_unlock;

		/* insert context into new entry */
		rc = -ENOMEM;
		dst = sidtab_do_lookup(s, count, 1);