Re: [PATCH] netlabel: cipso_v4: reject empty MLS level/cat lists and zero tail in cipso_v4_delopt()
From: Paul Moore <paul@paul-moore.com>
Date: 2026-09-20 01:25:54
Also in:
linux-security-module, lkml
On Sat, Sep 19, 2026 at 5:52 PM Hui Peng [off-list ref] wrote:
Fix three bugs in NetLabel CIPSOv4 handling:
1. In netlbl_cipsov4_add_std(), an empty NLBL_CIPSOV4_A_MLSLVLLST or
NLBL_CIPSOV4_A_MLSCATLST leaves local_size or cipso_size at 0, causing
kcalloc(0, ...) to return ZERO_SIZE_PTR (0x10), which bypasses NULL
checks and installs ZERO_SIZE_PTR arrays into cipso_v4_doi_list. Reject
0-sized level or category tables before allocation.
2. In netlbl_cipsov4_remove_cb(), also inspect NETLBL_NLTYPE_ADDRSELECT
entries so IPv4 address-selected domain mappings referencing a removed
CIPSOv4 DOI are properly cleaned up.
3. In cipso_v4_delopt(), zero the trailing cipso_len bytes with IPOPT_END
after memmove() and pass opt->opt.optlen - cipso_len to
cipso_v4_get_actual_opt_len() so stale tail bytes are not re-parsed.
Fixes: 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
Fixes: 389fb800ac8b ("netlabel: Label incoming TCP connections correctly in SELinux")
Assisted-by: LLM
Signed-off-by: Hui Peng <redacted>Generally speaking, unless multiple problems are tightly related, one patch should focus on fixing one problem. As you have identified three potential issues that don't appear to be related, please break this patch up into three patches and resubmit. Thanks.
quoted hunk ↗ jump to hunk
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c index a05aa075de1a..4ac1a4965abe 100644 --- a/net/ipv4/cipso_ipv4.c +++ b/net/ipv4/cipso_ipv4.c@@ -2025,9 +2025,11 @@ static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr) memmove(cipso_ptr, cipso_ptr + cipso_len, opt->opt.optlen - cipso_off - cipso_len); + memset(&opt->opt.__data[opt->opt.optlen - cipso_len], + IPOPT_END, cipso_len); optlen_new = cipso_v4_get_actual_opt_len(opt->opt.__data, - opt->opt.optlen); + opt->opt.optlen - cipso_len); hdr_delta = opt->opt.optlen; opt->opt.optlen = (optlen_new + 3) & ~3; hdr_delta -= opt->opt.optlen;diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c index b080e666523f..9bb28236b8fe 100644 --- a/net/netlabel/netlabel_cipso_v4.c +++ b/net/netlabel/netlabel_cipso_v4.c@@ -185,6 +185,9 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, break; } } + if (doi_def->map.std->lvl.local_size == 0 || + doi_def->map.std->lvl.cipso_size == 0) + goto add_std_failure; doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size, sizeof(u32), GFP_KERNEL | __GFP_NOWARN);@@ -260,6 +263,9 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, break; } } + if (doi_def->map.std->cat.local_size == 0 || + doi_def->map.std->cat.cipso_size == 0) + goto add_std_failure; doi_def->map.std->cat.local = kcalloc( doi_def->map.std->cat.local_size, sizeof(u32),@@ -680,10 +686,21 @@ static int netlbl_cipsov4_listall(struct sk_buff *skb, static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg) { struct netlbl_domhsh_walk_arg *cb_arg = arg; + struct netlbl_af4list *iter4; + struct netlbl_domaddr4_map *map4; if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 && entry->def.cipso->doi == cb_arg->doi) return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info); + else if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) { + netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) { + map4 = netlbl_domhsh_addr4_entry(iter4); + if (map4->def.type == NETLBL_NLTYPE_CIPSOV4 && + map4->def.cipso->doi == cb_arg->doi) + return netlbl_domhsh_remove_entry(entry, + cb_arg->audit_info); + } + } return 0; }
-- paul-moore.com