[PATCH AUTOSEL 4.9 8/8] selinux: Add boundary check in put_entry()

From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Xiu Jianfeng <xiujianfeng@huawei.com>,
	Paul Moore <paul@paul-moore.com>, Sasha Levin <sashal@kernel.org>,
	stephen.smalley.work@gmail.com, eparis@parisplace.org,
	selinux@vger.kernel.org
Subject: [PATCH AUTOSEL 4.9 8/8] selinux: Add boundary check in put_entry()
Date: Sun,  7 Aug 2022 21:40:03 -0400	[thread overview]
Message-ID: <20220808014005.317064-8-sashal@kernel.org> (raw)
In-Reply-To: <20220808014005.317064-1-sashal@kernel.org>

From: Xiu Jianfeng <xiujianfeng@huawei.com>

[ Upstream commit 15ec76fb29be31df2bccb30fc09875274cba2776 ]

Just like next_entry(), boundary check is necessary to prevent memory
out-of-bound access.

Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/selinux/ss/policydb.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
index 725d5945a97e..178d8804ecb1 100644
--- a/security/selinux/ss/policydb.h
+++ b/security/selinux/ss/policydb.h
@@ -349,6 +349,8 @@ static inline int put_entry(const void *buf, size_t bytes, int num, struct polic
 {
 	size_t len = bytes * num;
 
+	if (len > fp->len)
+		return -EINVAL;
 	memcpy(fp->data, buf, len);
 	fp->data += len;
 	fp->len -= len;
-- 
2.35.1

