diff options
| author | John Johansen <john.johansen@canonical.com> | 2018-05-04 01:57:47 -0700 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2018-05-08 08:34:08 -0700 |
| commit | 52e7128ebbdd7b05ba8615efbe410e88a5925a1d (patch) | |
| tree | 0fe567b5838aee30bc7d3a6306bdc92e4c75830d /security | |
| parent | 3107e8cb9219cff359b93dde257c030b500e74b7 (diff) | |
| download | linux-52e7128ebbdd7b05ba8615efbe410e88a5925a1d.tar.gz linux-52e7128ebbdd7b05ba8615efbe410e88a5925a1d.tar.bz2 linux-52e7128ebbdd7b05ba8615efbe410e88a5925a1d.zip | |
apparmor: fix '*seclen' is never less than zero
smatch warnings:
security/apparmor/secid.c:162 apparmor_secid_to_secctx() warn: unsigned '*seclen' is never less than zero.
vim +162 security/apparmor/secid.c
140
141 int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
142 {
143 /* TODO: cache secctx and ref count so we don't have to recreate */
144 struct aa_label *label = aa_secid_to_label(secid);
145
146 AA_BUG(!secdata);
147 AA_BUG(!seclen);
148
149 if (!label)
150 return -EINVAL;
151
152 if (secdata)
153 *seclen = aa_label_asxprint(secdata, root_ns, label,
154 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
155 FLAG_HIDDEN_UNCONFINED |
156 FLAG_ABS_ROOT, GFP_ATOMIC);
157 else
158 *seclen = aa_label_snxprint(NULL, 0, root_ns, label,
159 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
160 FLAG_HIDDEN_UNCONFINED |
161 FLAG_ABS_ROOT);
> 162 if (*seclen < 0)
163 return -ENOMEM;
164
165 return 0;
166 }
167
Fixes: c092921219d2 ("apparmor: add support for mapping secids and using secctxes")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/secid.c | 20 |
1 files changed, 11 insertions, 9 deletions
diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c index 502924853986..c2f0c1571156 100644 --- a/security/apparmor/secid.c +++ b/security/apparmor/secid.c @@ -142,6 +142,7 @@ int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) { /* TODO: cache secctx and ref count so we don't have to recreate */ struct aa_label *label = aa_secid_to_label(secid); + int len; AA_BUG(!secdata); AA_BUG(!seclen); @@ -150,18 +151,19 @@ int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) return -EINVAL; if (secdata) - *seclen = aa_label_asxprint(secdata, root_ns, label, - FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | - FLAG_HIDDEN_UNCONFINED | - FLAG_ABS_ROOT, GFP_ATOMIC); + len = aa_label_asxprint(secdata, root_ns, label, + FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | + FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT, + GFP_ATOMIC); else - *seclen = aa_label_snxprint(NULL, 0, root_ns, label, - FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | - FLAG_HIDDEN_UNCONFINED | - FLAG_ABS_ROOT); - if (*seclen < 0) + len = aa_label_snxprint(NULL, 0, root_ns, label, + FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | + FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT); + if (len < 0) return -ENOMEM; + *seclen = len; + return 0; } |