[PATCH] smackfs: fix IPv6 netlabel prefix mask for non-16-aligned lengths

[PATCH] smackfs: fix IPv6 netlabel prefix mask for non-16-aligned lengths

[Hongjian Dai]

smk_write_net6addr() builds the partial-word mask as (1 << m) - 1,
which keeps the low m bits instead of the high m bits (e.g. /33
yields 0x0001 instead of 0x8000), and stores it without htons()
while the address words are in network byte order. Any prefix with
mask % 16 != 0 is truncated to the wrong network and mislabeled.

Take the high m bits and convert to network byte order, matching
how newname words are stored with htons().

Fixes: 21abb1ec414c ("Smack: IPv6 host labeling")
---
 security/smack/smackfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index a72bc7fabea9..6d680424a8c3 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -1506,7 +1506,7 @@ static ssize_t smk_write_net6addr(struct file *file, const char __user *buf,
 			fullmask.s6_addr16[i] = 0xffff;
 			m -= 16;
 		} else if (m > 0) {
-			fullmask.s6_addr16[i] = (1 << m) - 1;
+			fullmask.s6_addr16[i] = htons(0xffff << (16 - m));
 			m = 0;
 		} else
 			fullmask.s6_addr16[i] = 0;
-- 
2.43.0

Re: [PATCH] smackfs: fix IPv6 netlabel prefix mask for non-16-aligned lengths

[sashiko-bot]

> smk_write_net6addr() builds the partial-word mask as (1 << m) - 1,
> which keeps the low m bits instead of the high m bits (e.g. /33
> yields 0x0001 instead of 0x8000), and stores it without htons()
> while the address words are in network byte order. Any prefix with
> mask % 16 != 0 is truncated to the wrong network and mislabeled.
> 
> Take the high m bits and convert to network byte order, matching
> how newname words are stored with htons().
> 
> Fixes: 21abb1ec414c ("Smack: IPv6 host labeling")

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/A82C90B4956EE3A9+20260922144738.9594-1-daihongjian@kylinsec.com.cn?part=1