--- v12
+++ v24
@@ -8,22 +8,25 @@
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: John Johansen <john.johansen@canonical.com>
+Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
+Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
-cc: netdev@vger.kernel.com
+Cc: netdev@vger.kernel.org
---
- include/net/netlabel.h | 8 ++--
- net/ipv4/cipso_ipv4.c | 6 ++-
+ include/net/netlabel.h | 8 +--
+ net/ipv4/cipso_ipv4.c | 26 ++++++----
net/netlabel/netlabel_kapi.c | 6 +--
- net/netlabel/netlabel_unlabeled.c | 57 +++++++++++------------------
+ net/netlabel/netlabel_unlabeled.c | 79 +++++++++--------------------
net/netlabel/netlabel_unlabeled.h | 2 +-
security/selinux/hooks.c | 2 +-
security/selinux/include/security.h | 1 +
security/selinux/netlabel.c | 2 +-
security/selinux/ss/services.c | 4 +-
security/smack/smack.h | 1 +
- security/smack/smack_lsm.c | 5 ++-
- security/smack/smackfs.c | 10 +++--
- 12 files changed, 50 insertions(+), 54 deletions(-)
+ security/smack/smack_access.c | 2 +-
+ security/smack/smack_lsm.c | 11 ++--
+ security/smack/smackfs.c | 10 ++--
+ 13 files changed, 68 insertions(+), 86 deletions(-)
diff --git a/include/net/netlabel.h b/include/net/netlabel.h
index 43ae50337685..73fc25b4042b 100644
@@ -66,31 +69,59 @@
{
return -ENOSYS;
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
-index 376882215919..8ee7a804423e 100644
+index 471d33a0d095..1ac343d02b58 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
-@@ -1467,7 +1467,8 @@ static int cipso_v4_gentag_loc(const struct cipso_v4_doi *doi_def,
+@@ -106,15 +106,17 @@ int cipso_v4_rbm_strictvalid = 1;
+ /* Base length of the local tag (non-standard tag).
+ * Tag definition (may change between kernel versions)
+ *
+- * 0 8 16 24 32
+- * +----------+----------+----------+----------+
+- * | 10000000 | 00000110 | 32-bit secid value |
+- * +----------+----------+----------+----------+
+- * | in (host byte order)|
+- * +----------+----------+
+- *
++ * 0 8 16 16 + sizeof(struct lsmblob)
++ * +----------+----------+---------------------+
++ * | 10000000 | 00000110 | LSM blob data |
++ * +----------+----------+---------------------+
++ *
++ * All secid and flag fields are in host byte order.
++ * The lsmblob structure size varies depending on which
++ * Linux security modules are built in the kernel.
++ * The data is opaque.
+ */
+-#define CIPSO_V4_TAG_LOC_BLEN 6
++#define CIPSO_V4_TAG_LOC_BLEN (2 + sizeof(struct lsmblob))
+
+ /*
+ * Helper Functions
+@@ -1469,7 +1471,11 @@ static int cipso_v4_gentag_loc(const struct cipso_v4_doi *doi_def,
buffer[0] = CIPSO_V4_TAG_LOCAL;
buffer[1] = CIPSO_V4_TAG_LOC_BLEN;
- *(u32 *)&buffer[2] = secattr->attr.secid;
-+ /* only one netlabel user - the first */
-+ *(u32 *)&buffer[2] = secattr->attr.lsmblob.secid[0];
++ /* Ensure that there is sufficient space in the CIPSO header
++ * for the LSM data. */
++ BUILD_BUG_ON(CIPSO_V4_TAG_LOC_BLEN > CIPSO_V4_OPT_LEN_MAX);
++ memcpy(&buffer[2], &secattr->attr.lsmblob,
++ sizeof(secattr->attr.lsmblob));
return CIPSO_V4_TAG_LOC_BLEN;
}
-@@ -1487,7 +1488,8 @@ static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
+@@ -1489,7 +1495,7 @@ static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
const unsigned char *tag,
struct netlbl_lsm_secattr *secattr)
{
- secattr->attr.secid = *(u32 *)&tag[2];
-+ /* only one netlabel user - the first */
-+ secattr->attr.lsmblob.secid[0] = *(u32 *)&tag[2];
++ memcpy(&secattr->attr.lsmblob, &tag[2], sizeof(secattr->attr.lsmblob));
secattr->flags |= NETLBL_SECATTR_SECID;
return 0;
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
-index 409a3ae47ce2..f2ebd43a7992 100644
+index 5e1239cef000..bbfaff539416 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -196,7 +196,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
@@ -121,7 +152,7 @@
/**
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
-index c03fe9a4f7b9..3b0f07b59436 100644
+index aa53a94115f4..3befe0738d31 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -66,7 +66,7 @@ struct netlbl_unlhsh_tbl {
@@ -142,7 +173,7 @@
struct netlbl_af6list list;
struct rcu_head rcu;
-@@ -219,7 +219,7 @@ static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
+@@ -220,7 +220,7 @@ static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
* @iface: the associated interface entry
* @addr: IPv4 address in network byte order
* @mask: IPv4 address mask in network byte order
@@ -151,7 +182,7 @@
*
* Description:
* Add a new address entry into the unlabeled connection hash table using the
-@@ -230,7 +230,7 @@ static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
+@@ -231,7 +231,7 @@ static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
const struct in_addr *addr,
const struct in_addr *mask,
@@ -160,7 +191,7 @@
{
int ret_val;
struct netlbl_unlhsh_addr4 *entry;
-@@ -242,7 +242,7 @@ static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
+@@ -243,7 +243,7 @@ static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
entry->list.addr = addr->s_addr & mask->s_addr;
entry->list.mask = mask->s_addr;
entry->list.valid = 1;
@@ -169,7 +200,7 @@
spin_lock(&netlbl_unlhsh_lock);
ret_val = netlbl_af4list_add(&entry->list, &iface->addr4_list);
-@@ -259,7 +259,7 @@ static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
+@@ -260,7 +260,7 @@ static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
* @iface: the associated interface entry
* @addr: IPv6 address in network byte order
* @mask: IPv6 address mask in network byte order
@@ -178,7 +209,7 @@
*
* Description:
* Add a new address entry into the unlabeled connection hash table using the
-@@ -270,7 +270,7 @@ static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
+@@ -271,7 +271,7 @@ static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
const struct in6_addr *addr,
const struct in6_addr *mask,
@@ -187,7 +218,7 @@
{
int ret_val;
struct netlbl_unlhsh_addr6 *entry;
-@@ -286,7 +286,7 @@ static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
+@@ -287,7 +287,7 @@ static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
entry->list.mask = *mask;
entry->list.valid = 1;
@@ -196,7 +227,7 @@
spin_lock(&netlbl_unlhsh_lock);
ret_val = netlbl_af6list_add(&entry->list, &iface->addr6_list);
-@@ -365,7 +365,7 @@ int netlbl_unlhsh_add(struct net *net,
+@@ -366,7 +366,7 @@ int netlbl_unlhsh_add(struct net *net,
const void *addr,
const void *mask,
u32 addr_len,
@@ -205,7 +236,7 @@
struct netlbl_audit *audit_info)
{
int ret_val;
-@@ -374,7 +374,6 @@ int netlbl_unlhsh_add(struct net *net,
+@@ -375,7 +375,6 @@ int netlbl_unlhsh_add(struct net *net,
struct netlbl_unlhsh_iface *iface;
struct audit_buffer *audit_buf = NULL;
struct lsmcontext context;
@@ -213,7 +244,7 @@
if (addr_len != sizeof(struct in_addr) &&
addr_len != sizeof(struct in6_addr))
-@@ -407,7 +406,7 @@ int netlbl_unlhsh_add(struct net *net,
+@@ -408,7 +407,7 @@ int netlbl_unlhsh_add(struct net *net,
const struct in_addr *addr4 = addr;
const struct in_addr *mask4 = mask;
@@ -222,7 +253,7 @@
if (audit_buf != NULL)
netlbl_af4list_audit_addr(audit_buf, 1,
dev_name,
-@@ -420,7 +419,7 @@ int netlbl_unlhsh_add(struct net *net,
+@@ -421,7 +420,7 @@ int netlbl_unlhsh_add(struct net *net,
const struct in6_addr *addr6 = addr;
const struct in6_addr *mask6 = mask;
@@ -231,17 +262,20 @@
if (audit_buf != NULL)
netlbl_af6list_audit_addr(audit_buf, 1,
dev_name,
-@@ -437,8 +436,7 @@ int netlbl_unlhsh_add(struct net *net,
+@@ -438,11 +437,7 @@ int netlbl_unlhsh_add(struct net *net,
unlhsh_add_return:
rcu_read_unlock();
if (audit_buf != NULL) {
+- /* lsmblob_init() puts secid into all of the secids in blob.
+- * security_secid_to_secctx() will know which security module
+- * to use to create the secctx. */
- lsmblob_init(&blob, secid);
- if (security_secid_to_secctx(&blob, &context) == 0) {
+ if (security_secid_to_secctx(lsmblob, &context) == 0) {
audit_log_format(audit_buf, " sec_obj=%s",
context.context);
security_release_secctx(&context);
-@@ -473,7 +471,6 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
+@@ -477,7 +472,6 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
struct audit_buffer *audit_buf;
struct net_device *dev;
struct lsmcontext context;
@@ -249,10 +283,13 @@
spin_lock(&netlbl_unlhsh_lock);
list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
-@@ -493,10 +490,8 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
+@@ -497,13 +491,8 @@ static int netlbl_unlhsh_remove_addr4(struct net *net,
addr->s_addr, mask->s_addr);
if (dev != NULL)
dev_put(dev);
+- /* lsmblob_init() puts entry->secid into all of the secids
+- * in blob. security_secid_to_secctx() will know which
+- * security module to use to create the secctx. */
- if (entry != NULL)
- lsmblob_init(&blob, entry->secid);
if (entry != NULL &&
@@ -261,7 +298,7 @@
audit_log_format(audit_buf, " sec_obj=%s",
context.context);
security_release_secctx(&context);
-@@ -537,7 +532,6 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
+@@ -544,7 +533,6 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
struct audit_buffer *audit_buf;
struct net_device *dev;
struct lsmcontext context;
@@ -269,10 +306,13 @@
spin_lock(&netlbl_unlhsh_lock);
list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
-@@ -556,10 +550,8 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
+@@ -563,13 +551,8 @@ static int netlbl_unlhsh_remove_addr6(struct net *net,
addr, mask);
if (dev != NULL)
dev_put(dev);
+- /* lsmblob_init() puts entry->secid into all of the secids
+- * in blob. security_secid_to_secctx() will know which
+- * security module to use to create the secctx. */
- if (entry != NULL)
- lsmblob_init(&blob, entry->secid);
if (entry != NULL &&
@@ -281,30 +321,38 @@
audit_log_format(audit_buf, " sec_obj=%s",
context.context);
security_release_secctx(&context);
-@@ -913,9 +905,8 @@ static int netlbl_unlabel_staticadd(struct sk_buff *skb,
+@@ -923,14 +906,8 @@ static int netlbl_unlabel_staticadd(struct sk_buff *skb,
if (ret_val != 0)
return ret_val;
-- /* scaffolding with the [0] */
- return netlbl_unlhsh_add(&init_net,
-- dev_name, addr, mask, addr_len, blob.secid[0],
-+ dev_name, addr, mask, addr_len, &blob,
- &audit_info);
+- /* netlbl_unlhsh_add will be changed to pass a struct lsmblob *
+- * instead of a u32 later in this patch set. security_secctx_to_secid()
+- * will only be setting one entry in the lsmblob struct, so it is
+- * safe to use lsmblob_value() to get that one value. */
+-
+- return netlbl_unlhsh_add(&init_net,
+- dev_name, addr, mask, addr_len,
+- lsmblob_value(&blob), &audit_info);
++ return netlbl_unlhsh_add(&init_net, dev_name, addr, mask, addr_len,
++ &blob, &audit_info);
}
-@@ -963,10 +954,8 @@ static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
+ /**
+@@ -977,11 +954,8 @@ static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
if (ret_val != 0)
return ret_val;
-- /* scaffolding with the [0] */
- return netlbl_unlhsh_add(&init_net,
-- NULL, addr, mask, addr_len, blob.secid[0],
-- &audit_info);
-+ NULL, addr, mask, addr_len, &blob, &audit_info);
+- /* security_secctx_to_secid() will only put one secid into the lsmblob
+- * so it's safe to use lsmblob_value() to get the secid. */
+- return netlbl_unlhsh_add(&init_net,
+- NULL, addr, mask, addr_len,
+- lsmblob_value(&blob), &audit_info);
++ return netlbl_unlhsh_add(&init_net, NULL, addr, mask, addr_len, &blob,
++ &audit_info);
}
/**
-@@ -1078,8 +1067,7 @@ static int netlbl_unlabel_staticlist_gen(u32 cmd,
+@@ -1093,8 +1067,7 @@ static int netlbl_unlabel_staticlist_gen(u32 cmd,
struct net_device *dev;
struct lsmcontext context;
void *data;
@@ -314,7 +362,7 @@
data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
cb_arg->seq, &netlbl_unlabel_gnl_family,
-@@ -1117,7 +1105,7 @@ static int netlbl_unlabel_staticlist_gen(u32 cmd,
+@@ -1132,7 +1105,7 @@ static int netlbl_unlabel_staticlist_gen(u32 cmd,
if (ret_val != 0)
goto list_cb_failure;
@@ -323,7 +371,7 @@
} else {
ret_val = nla_put_in6_addr(cb_arg->skb,
NLBL_UNLABEL_A_IPV6ADDR,
-@@ -1131,11 +1119,10 @@ static int netlbl_unlabel_staticlist_gen(u32 cmd,
+@@ -1146,14 +1119,10 @@ static int netlbl_unlabel_staticlist_gen(u32 cmd,
if (ret_val != 0)
goto list_cb_failure;
@@ -331,13 +379,16 @@
+ lsmb = (struct lsmblob *)&addr6->lsmblob;
}
+- /* lsmblob_init() secid into all of the secids in blob.
+- * security_secid_to_secctx() will know which security module
+- * to use to create the secctx. */
- lsmblob_init(&blob, secid);
- ret_val = security_secid_to_secctx(&blob, &context);
+ ret_val = security_secid_to_secctx(lsmb, &context);
if (ret_val != 0)
goto list_cb_failure;
ret_val = nla_put(cb_arg->skb,
-@@ -1487,7 +1474,7 @@ int netlbl_unlabel_getattr(const struct sk_buff *skb,
+@@ -1512,7 +1481,7 @@ int netlbl_unlabel_getattr(const struct sk_buff *skb,
&iface->addr4_list);
if (addr4 == NULL)
goto unlabel_getattr_nolabel;
@@ -346,7 +397,7 @@
break;
}
#if IS_ENABLED(CONFIG_IPV6)
-@@ -1500,7 +1487,7 @@ int netlbl_unlabel_getattr(const struct sk_buff *skb,
+@@ -1525,7 +1494,7 @@ int netlbl_unlabel_getattr(const struct sk_buff *skb,
&iface->addr6_list);
if (addr6 == NULL)
goto unlabel_getattr_nolabel;
@@ -369,10 +420,10 @@
int netlbl_unlhsh_remove(struct net *net,
const char *dev_name,
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index b8501ca3c8f3..cd4743331800 100644
+index 7bc9a043a30a..60e35d31cc4c 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
-@@ -6871,7 +6871,7 @@ static int selinux_perf_event_write(struct perf_event *event)
+@@ -6952,7 +6952,7 @@ static int selinux_perf_event_write(struct perf_event *event)
}
#endif
@@ -382,17 +433,17 @@
.slot = LSMBLOB_NEEDED
};
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
-index ae840634e3c7..741ba0e6dd83 100644
+index 3cc8bab31ea8..6a40b47307ca 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
-@@ -70,6 +70,7 @@
+@@ -73,6 +73,7 @@
struct netlbl_lsm_secattr;
- extern int selinux_enabled;
+ extern int selinux_enabled_boot;
+extern struct lsm_id selinux_lsmid;
- /* Policy capabilities */
- enum {
+ /*
+ * type_datum properties
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index 6a94b31b5472..d8d7603ab14e 100644
--- a/security/selinux/netlabel.c
@@ -407,10 +458,10 @@
return NULL;
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
-index a5813c7629c1..2b7680903b6b 100644
+index 597b79703584..a18339bc883a 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
-@@ -3599,7 +3599,7 @@ int security_netlbl_secattr_to_sid(struct selinux_state *state,
+@@ -3787,7 +3787,7 @@ int security_netlbl_secattr_to_sid(struct selinux_state *state,
if (secattr->flags & NETLBL_SECATTR_CACHE)
*sid = *(u32 *)secattr->cache->data;
else if (secattr->flags & NETLBL_SECATTR_SECID)
@@ -419,7 +470,7 @@
else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) {
rc = -EIDRM;
ctx = sidtab_search(sidtab, SECINITSID_NETMSG);
-@@ -3672,7 +3672,7 @@ int security_netlbl_sid_to_secattr(struct selinux_state *state,
+@@ -3863,7 +3863,7 @@ int security_netlbl_sid_to_secattr(struct selinux_state *state,
if (secattr->domain == NULL)
goto out;
@@ -429,10 +480,10 @@
mls_export_netlbl_lvl(policydb, ctx, secattr);
rc = mls_export_netlbl_cat(policydb, ctx, secattr);
diff --git a/security/smack/smack.h b/security/smack/smack.h
-index 2836540f9577..6e76b6b33063 100644
+index 0f8d0feb89a4..b06fc332a1f9 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
-@@ -316,6 +316,7 @@ void smk_destroy_label_list(struct list_head *list);
+@@ -303,6 +303,7 @@ int smack_populate_secattr(struct smack_known *skp);
* Shared data.
*/
extern int smack_enabled;
@@ -440,21 +491,41 @@
extern int smack_cipso_direct;
extern int smack_cipso_mapped;
extern struct smack_known *smack_net_ambient;
+diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
+index 7eabb448acab..fccd5da3014e 100644
+--- a/security/smack/smack_access.c
++++ b/security/smack/smack_access.c
+@@ -522,7 +522,7 @@ int smack_populate_secattr(struct smack_known *skp)
+ {
+ int slen;
+
+- skp->smk_netlabel.attr.secid = skp->smk_secid;
++ skp->smk_netlabel.attr.lsmblob.secid[smack_lsmid.slot] = skp->smk_secid;
+ skp->smk_netlabel.domain = skp->smk_known;
+ skp->smk_netlabel.cache = netlbl_secattr_cache_alloc(GFP_ATOMIC);
+ if (skp->smk_netlabel.cache != NULL) {
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
-index 8e960f82bf3f..7349ce263759 100644
+index ef04029dcdf1..03a1c40174d7 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
-@@ -3775,7 +3775,8 @@ static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap,
- /*
- * Looks like a fallback, which gives us a secid.
- */
+@@ -3721,11 +3721,12 @@ static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap,
+ if ((sap->flags & NETLBL_SECATTR_CACHE) != 0)
+ return (struct smack_known *)sap->cache->data;
+
++ /*
++ * Looks like a fallback, which gives us a secid.
++ */
+ if ((sap->flags & NETLBL_SECATTR_SECID) != 0)
+- /*
+- * Looks like a fallback, which gives us a secid.
+- */
- return smack_from_secid(sap->attr.secid);
+ return smack_from_secid(
+ sap->attr.lsmblob.secid[smack_lsmid.slot]);
- /*
- * Without guidance regarding the smack value
- * for the packet fall back on the network
-@@ -4597,7 +4598,7 @@ struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
+
+ if ((sap->flags & NETLBL_SECATTR_MLS_LVL) != 0) {
+ /*
+@@ -4699,7 +4700,7 @@ struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
.lbs_sock = sizeof(struct socket_smack),
};
@@ -464,10 +535,10 @@
.slot = LSMBLOB_NEEDED
};
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
-index e3e05c04dbd1..d10e9c96717e 100644
+index 5d44b7d258ef..ad946ccf5023 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
-@@ -1122,6 +1122,7 @@ static void smk_net4addr_insert(struct smk_net4addr *new)
+@@ -1140,6 +1140,7 @@ static void smk_net4addr_insert(struct smk_net4addr *new)
static ssize_t smk_write_net4addr(struct file *file, const char __user *buf,
size_t count, loff_t *ppos)
{
@@ -475,7 +546,7 @@
struct smk_net4addr *snp;
struct sockaddr_in newname;
char *smack;
-@@ -1253,10 +1254,13 @@ static ssize_t smk_write_net4addr(struct file *file, const char __user *buf,
+@@ -1271,10 +1272,13 @@ static ssize_t smk_write_net4addr(struct file *file, const char __user *buf,
* this host so that incoming packets get labeled.
* but only if we didn't get the special CIPSO option
*/
@@ -493,5 +564,5 @@
if (rc == 0)
rc = count;
--
-2.20.1
+2.25.4