Re: [PATCH v2 1/5] selinux: zero-initialize permission name array in masked av dump

[sashiko-bot@kernel.org]

> From: Christian Göttsche <cgzones@googlemail.com>
> 
> security_dump_masked_av() declares an on-stack array
> 
> 	char *permission_names[SEL_VEC_MAX];
> 
> and only fills the entries that correspond to permissions actually
> defined for the target class (and its common) via hashtab_map() and
> dump_masked_av_helper().  It then walks the set bits of the masked
> access vector and logs, for each bit, permission_names[index] or the
> "????" fallback when the slot is NULL.
> 
> The array is never initialized, so any set bit whose index has no
> defined permission for the class reads an uninitialized stack pointer,
> which is then passed to audit_log_format("%s").
> 
> Zero-initialize the array so undefined slots are NULL and are reported
> as "????", exactly as the existing fallback intends.  Rejecting such AV
> rules at load time is deliberately not done here: it would break
> policies that older toolchains legitimately produced.
> 
> Fixes: 44c2d9bdd702 ("Add audit messages on type boundary violations")
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109153802.76176-5-cgoettsche@seltendoof.de?part=1