Re: [PATCH v2 5/7] Smack: hooks for secctx_to_lsmprop and update_lsmprop

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] smack_secctx_to_lsmprop unconditionally returns success even when a label is unrecognized, setting prop->smack.skp to NULL which causes subsequent LSM hooks to crash.
--

commit f9e66992c2da2f752b05c3f6b558475dc2678c3b
Author: Casey Schaufler <casey@schaufler-ca.com>

Smack: hooks for secctx_to_lsmprop and update_lsmprop

Implement these hooks.

> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index ff115068c5c06..fcfadd5d99941 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
[ ... ]
> @@ -4909,6 +4909,37 @@ static int smack_lsmprop_to_secctx(struct lsm_prop *prop,
>  	return smack_to_secctx(prop->smack.skp, cp);
>  }
>  
> +/**
> + * smack_secctx_to_lsmprop - add the smack label to an lsmprop
> + * @secdata: smack label
> + * @seclen: how long label is
> + * @prop: where to put the result
> + *
> + * Exists for audit and networking code.
> + */
> +static int smack_secctx_to_lsmprop(const char *secdata, u32 seclen,
> +				   struct lsm_prop *prop)
> +{
> +	prop->smack.skp = smk_find_entry(secdata);
> +
> +	return 0;

[Severity: Critical]
Will this return 0 (success) even when a label is unrecognized and 
smk_find_entry() returns NULL?

If an unprivileged user with CAP_NET_ADMIN in a namespace configures an
invalid Smack label via Netfilter (e.g., xt_SECMARK or nft_meta), this
function will return success but leave prop->smack.skp as NULL.

Because it returned success, the networking code will consider the lsm_prop
valid. When a network packet hits an NFQUEUE target, the queue attempts to
retrieve the security context by calling security_lsmprop_to_secctx(), which
invokes smack_lsmprop_to_secctx() and blindly passes the NULL pointer to
smack_to_secctx():

security/smack/smack_lsm.c:smack_lsmprop_to_secctx() {
	return smack_to_secctx(prop->smack.skp, cp);
}

This leads to an immediate kernel panic when the NULL pointer is dereferenced:

security/smack/smack_lsm.c:smack_to_secctx() {
	int len = strlen(skp->smk_known);
    ...
}

Could this function be updated to return an error code such as -EINVAL when
the label is unrecognized, preventing the crash?

> +}

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902220150.18586-1-casey@schaufler-ca.com?part=5