From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:60185 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1945920AbcHRK5Q (ORCPT ); Thu, 18 Aug 2016 06:57:16 -0400 Subject: Patch "netlabel: add address family checks to netlbl_{sock,req}_delattr()" has been added to the 4.4-stable tree To: paul@paul-moore.com, gregkh@linuxfoundation.org, maninder1.s@samsung.com Cc: , From: Date: Thu, 18 Aug 2016 12:57:02 +0200 Message-ID: <147151782210076@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled netlabel: add address family checks to netlbl_{sock,req}_delattr() to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: netlabel-add-address-family-checks-to-netlbl_-sock-req-_delattr.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 0e0e36774081534783aa8eeb9f6fbddf98d3c061 Mon Sep 17 00:00:00 2001 From: Paul Moore Date: Mon, 6 Jun 2016 15:17:20 -0400 Subject: netlabel: add address family checks to netlbl_{sock,req}_delattr() From: Paul Moore commit 0e0e36774081534783aa8eeb9f6fbddf98d3c061 upstream. It seems risky to always rely on the caller to ensure the socket's address family is correct before passing it to the NetLabel kAPI, especially since we see at least one LSM which didn't. Add address family checks to the *_delattr() functions to help prevent future problems. Reported-by: Maninder Singh Signed-off-by: Paul Moore Signed-off-by: Greg Kroah-Hartman --- net/netlabel/netlabel_kapi.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) --- a/net/netlabel/netlabel_kapi.c +++ b/net/netlabel/netlabel_kapi.c @@ -824,7 +824,11 @@ socket_setattr_return: */ void netlbl_sock_delattr(struct sock *sk) { - cipso_v4_sock_delattr(sk); + switch (sk->sk_family) { + case AF_INET: + cipso_v4_sock_delattr(sk); + break; + } } /** @@ -987,7 +991,11 @@ req_setattr_return: */ void netlbl_req_delattr(struct request_sock *req) { - cipso_v4_req_delattr(req); + switch (req->rsk_ops->family) { + case AF_INET: + cipso_v4_req_delattr(req); + break; + } } /** Patches currently in stable-queue which might be from paul@paul-moore.com are queue-4.4/netlabel-add-address-family-checks-to-netlbl_-sock-req-_delattr.patch queue-4.4/audit-fix-a-double-fetch-in-audit_log_single_execve_arg.patch