write in 30M

hc

2024-02-20 ea08eeccae9297f7aabd2ef7f0c2517ac4549acc

 kernel/security/selinux/netnode.c
..
..
@@ -1,3 +1,4 @@
1
+// SPDX-License-Identifier: GPL-2.0-only
1
2
 /*
2
3
  * Network node table
3
4
  *
..
..
@@ -11,21 +12,10 @@
11
12
  * This code is heavily based on the "netif" concept originally developed by
12
13
  * James Morris <jmorris@redhat.com>
13
14
  *   (see security/selinux/netif.c for more information)
14
- *
15
15
  */
16
16
 
17
17
 /*
18
18
  * (c) Copyright Hewlett-Packard Development Company, L.P., 2007
19
- *
20
- * This program is free software: you can redistribute it and/or modify
21
- * it under the terms of version 2 of the GNU General Public License as
22
- * published by the Free Software Foundation.
23
- *
24
- * This program is distributed in the hope that it will be useful,
25
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
26
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
27
- * GNU General Public License for more details.
28
- *
29
19
  */
30
20
 
31
21
 #include <linux/types.h>
..
..
@@ -191,7 +181,7 @@
191
181
  * @sid: node SID
192
182
  *
193
183
  * Description:
194
- * This function determines the SID of a network address by quering the
184
+ * This function determines the SID of a network address by querying the
195
185
  * security policy.  The result is added to the network address table to
196
186
  * speedup future queries.  Returns zero on success, negative values on
197
187
  * failure.
..
..
@@ -199,9 +189,9 @@
199
189
  */
200
190
 static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid)
201
191
 {
202
-	int ret = -ENOMEM;
192
+	int ret;
203
193
 	struct sel_netnode *node;
204
-	struct sel_netnode *new = NULL;
194
+	struct sel_netnode *new;
205
195
 
206
196
 	spin_lock_bh(&sel_netnode_lock);
207
197
 	node = sel_netnode_find(addr, family);
..
..
@@ -210,38 +200,36 @@
210
200
 		spin_unlock_bh(&sel_netnode_lock);
211
201
 		return 0;
212
202
 	}
203
+
213
204
 	new = kzalloc(sizeof(*new), GFP_ATOMIC);
214
-	if (new == NULL)
215
-		goto out;
216
205
 	switch (family) {
217
206
 	case PF_INET:
218
207
 		ret = security_node_sid(&selinux_state, PF_INET,
219
208
 					addr, sizeof(struct in_addr), sid);
220
-		new->nsec.addr.ipv4 = *(__be32 *)addr;
209
+		if (new)
210
+			new->nsec.addr.ipv4 = *(__be32 *)addr;
221
211
 		break;
222
212
 	case PF_INET6:
223
213
 		ret = security_node_sid(&selinux_state, PF_INET6,
224
214
 					addr, sizeof(struct in6_addr), sid);
225
-		new->nsec.addr.ipv6 = *(struct in6_addr *)addr;
215
+		if (new)
216
+			new->nsec.addr.ipv6 = *(struct in6_addr *)addr;
226
217
 		break;
227
218
 	default:
228
219
 		BUG();
229
220
 		ret = -EINVAL;
230
221
 	}
231
-	if (ret != 0)
232
-		goto out;
222
+	if (ret == 0 && new) {
223
+		new->nsec.family = family;
224
+		new->nsec.sid = *sid;
225
+		sel_netnode_insert(new);
226
+	} else
227
+		kfree(new);
233
228
 
234
-	new->nsec.family = family;
235
-	new->nsec.sid = *sid;
236
-	sel_netnode_insert(new);
237
-
238
-out:
239
229
 	spin_unlock_bh(&sel_netnode_lock);
240
-	if (unlikely(ret)) {
230
+	if (unlikely(ret))
241
231
 		pr_warn("SELinux: failure in %s(), unable to determine network node label\n",
242
232
 			__func__);
243
-		kfree(new);
244
-	}
245
233
 	return ret;
246
234
 }
247
235
 
..
..
@@ -303,7 +291,7 @@
303
291
 {
304
292
 	int iter;
305
293
 
306
-	if (!selinux_enabled)
294
+	if (!selinux_enabled_boot)
307
295
 		return 0;
308
296
 
309
297
 	for (iter = 0; iter < SEL_NETNODE_HASH_SIZE; iter++) {