Re: [PATCH v11 5/5] bpf: Only enable BPF LSM hooks when an LSM program is attached

[Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>]

On 2024/05/10 5:14, KP Singh wrote:
> +int security_toggle_hook(void *hook_addr, bool state)
> +{
> +	struct lsm_static_call *scalls = ((void *)&static_calls_table);
> +	unsigned long num_entries =
> +		(sizeof(static_calls_table) / sizeof(struct lsm_static_call));
> +	int i;
> +
> +	for (i = 0; i < num_entries; i++) {
> +		if (!scalls[i].hl->toggleable)
> +			continue;
> +
> +		if (!scalls[i].hl)
> +			continue;

If scalls[i].hl can be NULL, checking scalls[i].hl->toggleable
before scalls[i].hl is not safe.

> +
> +		if (scalls[i].hl->hook.lsm_func_addr != hook_addr)
> +			continue;
> +
> +		if (state)
> +			static_branch_enable(scalls[i].active);
> +		else
> +			static_branch_disable(scalls[i].active);
> +		return 0;
> +	}
> +	return -EINVAL;
> +}