* [PATCH] netlabel: cipso_v4: reject empty MLS level/cat lists and zero tail in cipso_v4_delopt()
@ 2026-09-19 21:52 Hui Peng
2026-09-20 1:25 ` Paul Moore
0 siblings, 1 reply; 2+ messages in thread
From: Hui Peng @ 2026-09-19 21:52 UTC (permalink / raw)
To: paul, davem, edumazet, kuba, pabeni, horms
Cc: netdev, linux-security-module, linux-kernel
Fix three bugs in NetLabel CIPSOv4 handling:
1. In netlbl_cipsov4_add_std(), an empty NLBL_CIPSOV4_A_MLSLVLLST or
NLBL_CIPSOV4_A_MLSCATLST leaves local_size or cipso_size at 0, causing
kcalloc(0, ...) to return ZERO_SIZE_PTR (0x10), which bypasses NULL
checks and installs ZERO_SIZE_PTR arrays into cipso_v4_doi_list. Reject
0-sized level or category tables before allocation.
2. In netlbl_cipsov4_remove_cb(), also inspect NETLBL_NLTYPE_ADDRSELECT
entries so IPv4 address-selected domain mappings referencing a removed
CIPSOv4 DOI are properly cleaned up.
3. In cipso_v4_delopt(), zero the trailing cipso_len bytes with IPOPT_END
after memmove() and pass opt->opt.optlen - cipso_len to
cipso_v4_get_actual_opt_len() so stale tail bytes are not re-parsed.
Fixes: 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
Fixes: 389fb800ac8b ("netlabel: Label incoming TCP connections correctly in SELinux")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index a05aa075de1a..4ac1a4965abe 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -2025,9 +2025,11 @@ static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr)
memmove(cipso_ptr, cipso_ptr + cipso_len,
opt->opt.optlen - cipso_off - cipso_len);
+ memset(&opt->opt.__data[opt->opt.optlen - cipso_len],
+ IPOPT_END, cipso_len);
optlen_new = cipso_v4_get_actual_opt_len(opt->opt.__data,
- opt->opt.optlen);
+ opt->opt.optlen - cipso_len);
hdr_delta = opt->opt.optlen;
opt->opt.optlen = (optlen_new + 3) & ~3;
hdr_delta -= opt->opt.optlen;
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index b080e666523f..9bb28236b8fe 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -185,6 +185,9 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
break;
}
}
+ if (doi_def->map.std->lvl.local_size == 0 ||
+ doi_def->map.std->lvl.cipso_size == 0)
+ goto add_std_failure;
doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
sizeof(u32),
GFP_KERNEL | __GFP_NOWARN);
@@ -260,6 +263,9 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
break;
}
}
+ if (doi_def->map.std->cat.local_size == 0 ||
+ doi_def->map.std->cat.cipso_size == 0)
+ goto add_std_failure;
doi_def->map.std->cat.local = kcalloc(
doi_def->map.std->cat.local_size,
sizeof(u32),
@@ -680,10 +686,21 @@ static int netlbl_cipsov4_listall(struct sk_buff *skb,
static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
{
struct netlbl_domhsh_walk_arg *cb_arg = arg;
+ struct netlbl_af4list *iter4;
+ struct netlbl_domaddr4_map *map4;
if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 &&
entry->def.cipso->doi == cb_arg->doi)
return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
+ else if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
+ netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) {
+ map4 = netlbl_domhsh_addr4_entry(iter4);
+ if (map4->def.type == NETLBL_NLTYPE_CIPSOV4 &&
+ map4->def.cipso->doi == cb_arg->doi)
+ return netlbl_domhsh_remove_entry(entry,
+ cb_arg->audit_info);
+ }
+ }
return 0;
}
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] netlabel: cipso_v4: reject empty MLS level/cat lists and zero tail in cipso_v4_delopt()
2026-09-19 21:52 [PATCH] netlabel: cipso_v4: reject empty MLS level/cat lists and zero tail in cipso_v4_delopt() Hui Peng
@ 2026-09-20 1:25 ` Paul Moore
0 siblings, 0 replies; 2+ messages in thread
From: Paul Moore @ 2026-09-20 1:25 UTC (permalink / raw)
To: Hui Peng
Cc: davem, edumazet, kuba, pabeni, horms, netdev,
linux-security-module, linux-kernel
On Sat, Sep 19, 2026 at 5:52 PM Hui Peng <benquike@gmail.com> wrote:
>
> Fix three bugs in NetLabel CIPSOv4 handling:
>
> 1. In netlbl_cipsov4_add_std(), an empty NLBL_CIPSOV4_A_MLSLVLLST or
> NLBL_CIPSOV4_A_MLSCATLST leaves local_size or cipso_size at 0, causing
> kcalloc(0, ...) to return ZERO_SIZE_PTR (0x10), which bypasses NULL
> checks and installs ZERO_SIZE_PTR arrays into cipso_v4_doi_list. Reject
> 0-sized level or category tables before allocation.
> 2. In netlbl_cipsov4_remove_cb(), also inspect NETLBL_NLTYPE_ADDRSELECT
> entries so IPv4 address-selected domain mappings referencing a removed
> CIPSOv4 DOI are properly cleaned up.
> 3. In cipso_v4_delopt(), zero the trailing cipso_len bytes with IPOPT_END
> after memmove() and pass opt->opt.optlen - cipso_len to
> cipso_v4_get_actual_opt_len() so stale tail bytes are not re-parsed.
>
> Fixes: 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
> Fixes: 389fb800ac8b ("netlabel: Label incoming TCP connections correctly in SELinux")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
Generally speaking, unless multiple problems are tightly related, one
patch should focus on fixing one problem. As you have identified
three potential issues that don't appear to be related, please break
this patch up into three patches and resubmit.
Thanks.
> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index a05aa075de1a..4ac1a4965abe 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -2025,9 +2025,11 @@ static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr)
>
> memmove(cipso_ptr, cipso_ptr + cipso_len,
> opt->opt.optlen - cipso_off - cipso_len);
> + memset(&opt->opt.__data[opt->opt.optlen - cipso_len],
> + IPOPT_END, cipso_len);
>
> optlen_new = cipso_v4_get_actual_opt_len(opt->opt.__data,
> - opt->opt.optlen);
> + opt->opt.optlen - cipso_len);
> hdr_delta = opt->opt.optlen;
> opt->opt.optlen = (optlen_new + 3) & ~3;
> hdr_delta -= opt->opt.optlen;
> diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
> index b080e666523f..9bb28236b8fe 100644
> --- a/net/netlabel/netlabel_cipso_v4.c
> +++ b/net/netlabel/netlabel_cipso_v4.c
> @@ -185,6 +185,9 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
> break;
> }
> }
> + if (doi_def->map.std->lvl.local_size == 0 ||
> + doi_def->map.std->lvl.cipso_size == 0)
> + goto add_std_failure;
> doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
> sizeof(u32),
> GFP_KERNEL | __GFP_NOWARN);
> @@ -260,6 +263,9 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
> break;
> }
> }
> + if (doi_def->map.std->cat.local_size == 0 ||
> + doi_def->map.std->cat.cipso_size == 0)
> + goto add_std_failure;
> doi_def->map.std->cat.local = kcalloc(
> doi_def->map.std->cat.local_size,
> sizeof(u32),
> @@ -680,10 +686,21 @@ static int netlbl_cipsov4_listall(struct sk_buff *skb,
> static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
> {
> struct netlbl_domhsh_walk_arg *cb_arg = arg;
> + struct netlbl_af4list *iter4;
> + struct netlbl_domaddr4_map *map4;
>
> if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 &&
> entry->def.cipso->doi == cb_arg->doi)
> return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
> + else if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
> + netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) {
> + map4 = netlbl_domhsh_addr4_entry(iter4);
> + if (map4->def.type == NETLBL_NLTYPE_CIPSOV4 &&
> + map4->def.cipso->doi == cb_arg->doi)
> + return netlbl_domhsh_remove_entry(entry,
> + cb_arg->audit_info);
> + }
> + }
>
> return 0;
> }
--
paul-moore.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-20 1:25 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-19 21:52 [PATCH] netlabel: cipso_v4: reject empty MLS level/cat lists and zero tail in cipso_v4_delopt() Hui Peng
2026-09-20 1:25 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®