Re: [syzbot] WARNING in smk_set_cipso (2)
flat view
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2021-05-11 16:07:09
Also in:
lkml
On 4/12/2021 6:28 AM, Tetsuo Handa wrote:
Commit 7ef4c19d245f3dc2 ("smackfs: restrict bytes count in smackfs write
functions") missed that count > SMK_CIPSOMAX check applies to only
format == SMK_FIXED24_FMT case.
Reported-by: syzbot <redacted>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>Added to smack-next. Thank you.
quoted hunk ↗ jump to hunk
--- security/smack/smackfs.c | 2 ++ 1 file changed, 2 insertions(+)diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index 22ded2c26089..1ad7d0d1ea62 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c@@ -855,6 +855,8 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, if (format == SMK_FIXED24_FMT && (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX)) return -EINVAL; + if (count > PAGE_SIZE) + return -EINVAL; data = memdup_user_nul(buf, count); if (IS_ERR(data))