[PATCH] netlabel: cipso_v4: reject empty MLS level/cat lists and zero tail in cipso_v4_delopt()
From: Hui Peng <hidden>
Date: 2026-09-19 21:52:48
Also in:
linux-security-module, lkml
Subsystem:
networking [general], networking [labeled] (netlabel, labeled ipsec, secmark), the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Paul Moore, Linus Torvalds
Fix three bugs in NetLabel CIPSOv4 handling:
1. In netlbl_cipsov4_add_std(), an empty NLBL_CIPSOV4_A_MLSLVLLST or
NLBL_CIPSOV4_A_MLSCATLST leaves local_size or cipso_size at 0, causing
kcalloc(0, ...) to return ZERO_SIZE_PTR (0x10), which bypasses NULL
checks and installs ZERO_SIZE_PTR arrays into cipso_v4_doi_list. Reject
0-sized level or category tables before allocation.
2. In netlbl_cipsov4_remove_cb(), also inspect NETLBL_NLTYPE_ADDRSELECT
entries so IPv4 address-selected domain mappings referencing a removed
CIPSOv4 DOI are properly cleaned up.
3. In cipso_v4_delopt(), zero the trailing cipso_len bytes with IPOPT_END
after memmove() and pass opt->opt.optlen - cipso_len to
cipso_v4_get_actual_opt_len() so stale tail bytes are not re-parsed.
Fixes: 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
Fixes: 389fb800ac8b ("netlabel: Label incoming TCP connections correctly in SELinux")
Assisted-by: LLM
Signed-off-by: Hui Peng <redacted>
---diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index a05aa075de1a..4ac1a4965abe 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c@@ -2025,9 +2025,11 @@ static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr) memmove(cipso_ptr, cipso_ptr + cipso_len, opt->opt.optlen - cipso_off - cipso_len); + memset(&opt->opt.__data[opt->opt.optlen - cipso_len], + IPOPT_END, cipso_len); optlen_new = cipso_v4_get_actual_opt_len(opt->opt.__data, - opt->opt.optlen); + opt->opt.optlen - cipso_len); hdr_delta = opt->opt.optlen; opt->opt.optlen = (optlen_new + 3) & ~3; hdr_delta -= opt->opt.optlen;
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index b080e666523f..9bb28236b8fe 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c@@ -185,6 +185,9 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, break; } } + if (doi_def->map.std->lvl.local_size == 0 || + doi_def->map.std->lvl.cipso_size == 0) + goto add_std_failure; doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size, sizeof(u32), GFP_KERNEL | __GFP_NOWARN);
@@ -260,6 +263,9 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, break; } } + if (doi_def->map.std->cat.local_size == 0 || + doi_def->map.std->cat.cipso_size == 0) + goto add_std_failure; doi_def->map.std->cat.local = kcalloc( doi_def->map.std->cat.local_size, sizeof(u32),
@@ -680,10 +686,21 @@ static int netlbl_cipsov4_listall(struct sk_buff *skb, static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg) { struct netlbl_domhsh_walk_arg *cb_arg = arg; + struct netlbl_af4list *iter4; + struct netlbl_domaddr4_map *map4; if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 && entry->def.cipso->doi == cb_arg->doi) return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info); + else if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) { + netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) { + map4 = netlbl_domhsh_addr4_entry(iter4); + if (map4->def.type == NETLBL_NLTYPE_CIPSOV4 && + map4->def.cipso->doi == cb_arg->doi) + return netlbl_domhsh_remove_entry(entry, + cb_arg->audit_info); + } + } return 0; }