hc
2024-12-19 9370bb92b2d16684ee45cf24e879c93c509162da
kernel/security/selinux/netnode.c
....@@ -1,3 +1,4 @@
1
+// SPDX-License-Identifier: GPL-2.0-only
12 /*
23 * Network node table
34 *
....@@ -11,21 +12,10 @@
1112 * This code is heavily based on the "netif" concept originally developed by
1213 * James Morris <jmorris@redhat.com>
1314 * (see security/selinux/netif.c for more information)
14
- *
1515 */
1616
1717 /*
1818 * (c) Copyright Hewlett-Packard Development Company, L.P., 2007
19
- *
20
- * This program is free software: you can redistribute it and/or modify
21
- * it under the terms of version 2 of the GNU General Public License as
22
- * published by the Free Software Foundation.
23
- *
24
- * This program is distributed in the hope that it will be useful,
25
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
26
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
- * GNU General Public License for more details.
28
- *
2919 */
3020
3121 #include <linux/types.h>
....@@ -191,7 +181,7 @@
191181 * @sid: node SID
192182 *
193183 * Description:
194
- * This function determines the SID of a network address by quering the
184
+ * This function determines the SID of a network address by querying the
195185 * security policy. The result is added to the network address table to
196186 * speedup future queries. Returns zero on success, negative values on
197187 * failure.
....@@ -199,9 +189,9 @@
199189 */
200190 static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid)
201191 {
202
- int ret = -ENOMEM;
192
+ int ret;
203193 struct sel_netnode *node;
204
- struct sel_netnode *new = NULL;
194
+ struct sel_netnode *new;
205195
206196 spin_lock_bh(&sel_netnode_lock);
207197 node = sel_netnode_find(addr, family);
....@@ -210,38 +200,36 @@
210200 spin_unlock_bh(&sel_netnode_lock);
211201 return 0;
212202 }
203
+
213204 new = kzalloc(sizeof(*new), GFP_ATOMIC);
214
- if (new == NULL)
215
- goto out;
216205 switch (family) {
217206 case PF_INET:
218207 ret = security_node_sid(&selinux_state, PF_INET,
219208 addr, sizeof(struct in_addr), sid);
220
- new->nsec.addr.ipv4 = *(__be32 *)addr;
209
+ if (new)
210
+ new->nsec.addr.ipv4 = *(__be32 *)addr;
221211 break;
222212 case PF_INET6:
223213 ret = security_node_sid(&selinux_state, PF_INET6,
224214 addr, sizeof(struct in6_addr), sid);
225
- new->nsec.addr.ipv6 = *(struct in6_addr *)addr;
215
+ if (new)
216
+ new->nsec.addr.ipv6 = *(struct in6_addr *)addr;
226217 break;
227218 default:
228219 BUG();
229220 ret = -EINVAL;
230221 }
231
- if (ret != 0)
232
- goto out;
222
+ if (ret == 0 && new) {
223
+ new->nsec.family = family;
224
+ new->nsec.sid = *sid;
225
+ sel_netnode_insert(new);
226
+ } else
227
+ kfree(new);
233228
234
- new->nsec.family = family;
235
- new->nsec.sid = *sid;
236
- sel_netnode_insert(new);
237
-
238
-out:
239229 spin_unlock_bh(&sel_netnode_lock);
240
- if (unlikely(ret)) {
230
+ if (unlikely(ret))
241231 pr_warn("SELinux: failure in %s(), unable to determine network node label\n",
242232 __func__);
243
- kfree(new);
244
- }
245233 return ret;
246234 }
247235
....@@ -303,7 +291,7 @@
303291 {
304292 int iter;
305293
306
- if (!selinux_enabled)
294
+ if (!selinux_enabled_boot)
307295 return 0;
308296
309297 for (iter = 0; iter < SEL_NETNODE_HASH_SIZE; iter++) {