hc
2024-10-12 a5969cabbb4660eab42b6ef0412cbbd1200cf14d
kernel/security/tomoyo/network.c
....@@ -233,14 +233,14 @@
233233 {
234234 u8 * const a_perm =
235235 &container_of(a, struct tomoyo_inet_acl, head)->perm;
236
- u8 perm = *a_perm;
236
+ u8 perm = READ_ONCE(*a_perm);
237237 const u8 b_perm = container_of(b, struct tomoyo_inet_acl, head)->perm;
238238
239239 if (is_delete)
240240 perm &= ~b_perm;
241241 else
242242 perm |= b_perm;
243
- *a_perm = perm;
243
+ WRITE_ONCE(*a_perm, perm);
244244 return !perm;
245245 }
246246
....@@ -259,14 +259,14 @@
259259 {
260260 u8 * const a_perm =
261261 &container_of(a, struct tomoyo_unix_acl, head)->perm;
262
- u8 perm = *a_perm;
262
+ u8 perm = READ_ONCE(*a_perm);
263263 const u8 b_perm = container_of(b, struct tomoyo_unix_acl, head)->perm;
264264
265265 if (is_delete)
266266 perm &= ~b_perm;
267267 else
268268 perm |= b_perm;
269
- *a_perm = perm;
269
+ WRITE_ONCE(*a_perm, perm);
270270 return !perm;
271271 }
272272
....@@ -505,6 +505,8 @@
505505 {
506506 struct tomoyo_inet_addr_info *i = &address->inet;
507507
508
+ if (addr_len < offsetofend(struct sockaddr, sa_family))
509
+ return 0;
508510 switch (addr->sa_family) {
509511 case AF_INET6:
510512 if (addr_len < SIN6_LEN_RFC2133)
....@@ -594,6 +596,8 @@
594596 {
595597 struct tomoyo_unix_addr_info *u = &address->unix0;
596598
599
+ if (addr_len < offsetofend(struct sockaddr, sa_family))
600
+ return 0;
597601 if (addr->sa_family != AF_UNIX)
598602 return 0;
599603 u->addr = ((struct sockaddr_un *) addr)->sun_path;
....@@ -609,7 +613,7 @@
609613 static bool tomoyo_kernel_service(void)
610614 {
611615 /* Nothing to do if I am a kernel service. */
612
- return uaccess_kernel();
616
+ return (current->flags & (PF_KTHREAD | PF_IO_WORKER)) == PF_KTHREAD;
613617 }
614618
615619 /**