On Mon, Aug 29, 2016 at 7:26 PM, Roberts, William C <william.c.roberts@xxxxxxxxx> wrote: >> -----Original Message----- >> From: Paul Moore [mailto:paul@xxxxxxxxxxxxxx] >> Sent: Monday, August 29, 2016 4:21 PM >> To: Roberts, William C <william.c.roberts@xxxxxxxxx> >> Cc: selinux@xxxxxxxxxxxxx; seandroid-list@xxxxxxxxxxxxx; Stephen Smalley >> <sds@xxxxxxxxxxxxx> >> Subject: Re: [PATCH 1/3] selinux: detect invalid ebitmap >> >> On Tue, Aug 23, 2016 at 4:49 PM, <william.c.roberts@xxxxxxxxx> wrote: >> > From: William Roberts <william.c.roberts@xxxxxxxxx> >> > >> > When count is 0 and the highbit is not zero, the ebitmap is not valid >> > and the internal node is not allocated. This causes issues when >> > routines, like mls_context_isvalid() attempt to use the >> > ebitmap_for_each_bit() and ebitmap_node_get_bit() as they assume a >> > highbit > 0 will have a node allocated. >> > --- >> > security/selinux/ss/ebitmap.c | 3 +++ >> > 1 file changed, 3 insertions(+) >> >> Hi William, >> >> This patch looks good to me, but do I have your permission to add your sign-off? > > Yes, I guess I missed it. Just so it's easy for you to copy paste: > Signed-off-by: William Roberts <william.c.roberts@xxxxxxxxx> Great, thanks! >> > diff --git a/security/selinux/ss/ebitmap.c >> > b/security/selinux/ss/ebitmap.c index 894b6cd..7d10e5d 100644 >> > --- a/security/selinux/ss/ebitmap.c >> > +++ b/security/selinux/ss/ebitmap.c >> > @@ -374,6 +374,9 @@ int ebitmap_read(struct ebitmap *e, void *fp) >> > goto ok; >> > } >> > >> > + if (e->highbit && !count) >> > + goto bad; >> > + >> > for (i = 0; i < count; i++) { >> > rc = next_entry(&startbit, fp, sizeof(u32)); >> > if (rc < 0) { >> > -- >> > 1.9.1 >> > >> > _______________________________________________ >> > Selinux mailing list >> > Selinux@xxxxxxxxxxxxx >> > To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. >> > To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx. >> >> >> >> -- >> paul moore >> www.paul-moore.com -- paul moore www.paul-moore.com _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
