* [PATCH 5.10/5.15/6.1] selinux: avoid implicit conversions in services code
2026-09-07 14:39 [PATCH 5.10/5.15/6.1 0/2] selinux: reject an unclaimed class value in security_get_classes() Alexander Martyniuk
@ 2026-09-07 14:39 ` Alexander Martyniuk
2026-09-07 14:39 ` [PATCH 5.10/5.15/6.1] selinux: reject an unclaimed class value in security_get_classes() Alexander Martyniuk
2026-09-08 0:53 ` [PATCH 5.10/5.15/6.1 0/2] " Sasha Levin
2 siblings, 0 replies; 4+ messages in thread
From: Alexander Martyniuk @ 2026-09-07 14:39 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman
Cc: Alexander Martyniuk, lvc-project, Paul Moore, Stephen Smalley,
Eric Paris, selinux, linux-kernel, Christian Göttsche
From: Christian Göttsche <cgzones@googlemail.com>
commit c50e125d057152bc68dfd5669b73611343653eb7 upstream.
Use u32 as the output parameter type in security_get_classes() and
security_get_permissions(), based on the type of the symtab nprim
member.
Declare the read-only class string parameter of
security_get_permissions() const.
Avoid several implicit conversions by using the identical type for the
destination.
Use the type identical to the source for local variables.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
[PM: cleanup extra whitespace in subject]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Alexander Martyniuk <alexevgmart@gmail.com>
---
Backport fix for CVE-2026-80912
security/selinux/include/security.h | 4 ++--
security/selinux/selinuxfs.c | 7 ++++---
security/selinux/ss/services.c | 23 ++++++++++++-----------
3 files changed, 18 insertions(+), 16 deletions(-)
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 393aff41d3ef..4176326ca4f5 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -379,9 +379,9 @@ int security_net_peersid_resolve(struct selinux_state *state,
u32 *peer_sid);
int security_get_classes(struct selinux_policy *policy,
- char ***classes, int *nclasses);
+ char ***classes, u32 *nclasses);
int security_get_permissions(struct selinux_policy *policy,
- char *class, char ***perms, int *nperms);
+ char *class, char ***perms, u32 *nperms);
int security_get_reject_unknown(struct selinux_state *state);
int security_get_allow_unknown(struct selinux_state *state);
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index ab804d4ea911..f74fdabaa541 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -1874,7 +1874,8 @@ static int sel_make_perm_files(struct selinux_policy *newpolicy,
char *objclass, int classvalue,
struct dentry *dir)
{
- int i, rc, nperms;
+ u32 i, nperms;
+ int rc;
char **perms;
rc = security_get_permissions(newpolicy, objclass, &perms, &nperms);
@@ -1944,8 +1945,8 @@ static int sel_make_classes(struct selinux_policy *newpolicy,
struct dentry *class_dir,
unsigned long *last_class_ino)
{
-
- int rc, nclasses, i;
+ u32 i, nclasses;
+ int rc;
char **classes;
rc = security_get_classes(newpolicy, &classes, &nclasses);
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 48d67b26110b..80340bc0ee6a 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -869,7 +869,7 @@ int security_bounded_transition(struct selinux_state *state,
struct sidtab *sidtab;
struct sidtab_entry *old_entry, *new_entry;
struct type_datum *type;
- int index;
+ u32 index;
int rc;
if (!selinux_initialized(state))
@@ -1537,7 +1537,7 @@ static int security_context_to_sid_core(struct selinux_state *state,
return -ENOMEM;
if (!selinux_initialized(state)) {
- int i;
+ u32 i;
for (i = 1; i < SECINITSID_NUM; i++) {
const char *s = initial_sid_to_string[i];
@@ -2886,7 +2886,6 @@ static inline int __security_genfs_sid(struct selinux_policy *policy,
{
struct policydb *policydb = &policy->policydb;
struct sidtab *sidtab = policy->sidtab;
- int len;
u16 sclass;
struct genfs *genfs;
struct ocontext *c;
@@ -2908,7 +2907,7 @@ static inline int __security_genfs_sid(struct selinux_policy *policy,
return -ENOENT;
for (c = genfs->head; c; c = c->next) {
- len = strlen(c->u.name);
+ size_t len = strlen(c->u.name);
if ((!c->v.sclass || sclass == c->v.sclass) &&
(strncmp(c->u.name, path, len) == 0))
break;
@@ -3402,7 +3401,7 @@ static int get_classes_callback(void *k, void *d, void *args)
{
struct class_datum *datum = d;
char *name = k, **classes = args;
- int value = datum->value - 1;
+ u32 value = datum->value - 1;
classes[value] = kstrdup(name, GFP_ATOMIC);
if (!classes[value])
@@ -3412,7 +3411,7 @@ static int get_classes_callback(void *k, void *d, void *args)
}
int security_get_classes(struct selinux_policy *policy,
- char ***classes, int *nclasses)
+ char ***classes, u32 *nclasses)
{
struct policydb *policydb;
int rc;
@@ -3428,7 +3427,8 @@ int security_get_classes(struct selinux_policy *policy,
rc = hashtab_map(&policydb->p_classes.table, get_classes_callback,
*classes);
if (rc) {
- int i;
+ u32 i;
+
for (i = 0; i < *nclasses; i++)
kfree((*classes)[i]);
kfree(*classes);
@@ -3442,7 +3442,7 @@ static int get_permissions_callback(void *k, void *d, void *args)
{
struct perm_datum *datum = d;
char *name = k, **perms = args;
- int value = datum->value - 1;
+ u32 value = datum->value - 1;
perms[value] = kstrdup(name, GFP_ATOMIC);
if (!perms[value])
@@ -3452,10 +3452,11 @@ static int get_permissions_callback(void *k, void *d, void *args)
}
int security_get_permissions(struct selinux_policy *policy,
- char *class, char ***perms, int *nperms)
+ char *class, char ***perms, u32 *nperms)
{
struct policydb *policydb;
- int rc, i;
+ u32 i;
+ int rc;
struct class_datum *match;
policydb = &policy->policydb;
@@ -3675,7 +3676,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule,
/* Check to see if the rule contains any selinux fields */
int selinux_audit_rule_known(struct audit_krule *rule)
{
- int i;
+ u32 i;
for (i = 0; i < rule->field_count; i++) {
struct audit_field *f = &rule->fields[i];
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH 5.10/5.15/6.1] selinux: reject an unclaimed class value in security_get_classes()
2026-09-07 14:39 [PATCH 5.10/5.15/6.1 0/2] selinux: reject an unclaimed class value in security_get_classes() Alexander Martyniuk
2026-09-07 14:39 ` [PATCH 5.10/5.15/6.1] selinux: avoid implicit conversions in services code Alexander Martyniuk
@ 2026-09-07 14:39 ` Alexander Martyniuk
2026-09-08 0:53 ` [PATCH 5.10/5.15/6.1 0/2] " Sasha Levin
2 siblings, 0 replies; 4+ messages in thread
From: Alexander Martyniuk @ 2026-09-07 14:39 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman
Cc: Alexander Martyniuk, lvc-project, Paul Moore, Stephen Smalley,
Eric Paris, James Morris, Christopher J. PeBenito, selinux,
linux-kernel, Bryam Vargas
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd upstream.
security_get_classes() sizes an array by p_classes.nprim and fills it at
value - 1, so a class value the policy never defines leaves a NULL.
sel_make_classes() passes every entry to sel_make_dir(), reaching the same
d_alloc_name() dereference as the permission array. The class symbol table
is allowed to be sparse (policydb_class_isvalid() exists to absorb that),
but this getter builds its own array straight from the hash table and has
no such predicate.
Fail the lookup when a value went unclaimed instead of handing out the
NULL. Conforming policies define every class they declare and are
unaffected.
Cc: stable@vger.kernel.org
Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Alexander Martyniuk <alexevgmart@gmail.com>
---
Backport fix for CVE-2026-80912
security/selinux/ss/services.c | 24 +++++++++++++++++++-----
1 file changed, 19 insertions(+), 5 deletions(-)
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 80340bc0ee6a..a1e3520596d6 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -3414,6 +3414,7 @@ int security_get_classes(struct selinux_policy *policy,
char ***classes, u32 *nclasses)
{
struct policydb *policydb;
+ u32 i;
int rc;
policydb = &policy->policydb;
@@ -3426,16 +3427,29 @@ int security_get_classes(struct selinux_policy *policy,
rc = hashtab_map(&policydb->p_classes.table, get_classes_callback,
*classes);
- if (rc) {
- u32 i;
+ if (rc)
+ goto err;
- for (i = 0; i < *nclasses; i++)
- kfree((*classes)[i]);
- kfree(*classes);
+ /*
+ * The class symtab may be sparse, which policydb_class_isvalid() exists
+ * to absorb; the callback fills this array by value, so an unclaimed
+ * one leaves a NULL that sel_make_classes() hands to sel_make_dir().
+ */
+ for (i = 0; i < *nclasses; i++) {
+ if (!(*classes)[i]) {
+ rc = -EINVAL;
+ goto err;
+ }
}
out:
return rc;
+
+err:
+ for (i = 0; i < *nclasses; i++)
+ kfree((*classes)[i]);
+ kfree(*classes);
+ return rc;
}
static int get_permissions_callback(void *k, void *d, void *args)
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread