Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris...

Pull security subsystem bugfixes from James Morris.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  selinux: fix selinux_inode_setxattr oops
  KEYS: linux/key-type.h needs linux/errno.h
  smack: off by one error

diff --git a/include/linux/key-type.h b/include/linux/key-type.h
index 39e3c082c49d489a32ab781e080b28236661877f..f0c651cda7b0b7a367b41160ed88ea487838a72b 100644 (file)
--- a/include/linux/key-type.h
+++ b/include/linux/key-type.h
@@ -13,6 +13,7 @@
 #define _LINUX_KEY_TYPE_H
 
 #include <linux/key.h>
+#include <linux/errno.h>
 
 #ifdef CONFIG_KEYS
 

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 94c45a1531a4c1199535b38a5eb0041075b29ce4..79690f401a5898c5d58004612d08131811059d2c 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2791,11 +2791,16 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
 
                        /* We strip a nul only if it is at the end, otherwise the
                         * context contains a nul and we should audit that */
-                       str = value;
-                       if (str[size - 1] == '\0')
-                               audit_size = size - 1;
-                       else
-                               audit_size = size;
+                       if (value) {
+                               str = value;
+                               if (str[size - 1] == '\0')
+                                       audit_size = size - 1;
+                               else
+                                       audit_size = size;
+                       } else {
+                               str = "";
+                               audit_size = 0;
+                       }
                        ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
                        audit_log_format(ab, "op=setxattr invalid_context=");
                        audit_log_n_untrustedstring(ab, value, audit_size);

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index d31e6d957c21a47733ca1d73e8a43ef7d3fae22c..b1b768e4049af3304d457451f06c8fa834909b89 100644 (file)
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -323,11 +323,11 @@ static int smk_parse_long_rule(const char *data, struct smack_rule *rule,
        int datalen;
        int rc = -1;
 
-       /*
-        * This is probably inefficient, but safe.
-        */
+       /* This is inefficient */
        datalen = strlen(data);
-       subject = kzalloc(datalen, GFP_KERNEL);
+
+       /* Our first element can be 64 + \0 with no spaces */
+       subject = kzalloc(datalen + 1, GFP_KERNEL);
        if (subject == NULL)
                return -1;
        object = kzalloc(datalen, GFP_KERNEL);