leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

apparmor: fix '*seclen' is never less than zero

Browse Source 
smatch warnings:
security/apparmor/secid.c:162 apparmor_secid_to_secctx() warn: unsigned '*seclen' is never less than zero.

vim +162 security/apparmor/secid.c

   140
   141	int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
   142	{
   143		/* TODO: cache secctx and ref count so we don't have to recreate */
   144		struct aa_label *label = aa_secid_to_label(secid);
   145
   146		AA_BUG(!secdata);
   147		AA_BUG(!seclen);
   148
   149		if (!label)
   150			return -EINVAL;
   151
   152		if (secdata)
   153			*seclen = aa_label_asxprint(secdata, root_ns, label,
   154						    FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
   155						    FLAG_HIDDEN_UNCONFINED |
   156						    FLAG_ABS_ROOT, GFP_ATOMIC);
   157		else
   158			*seclen = aa_label_snxprint(NULL, 0, root_ns, label,
   159						    FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
   160						    FLAG_HIDDEN_UNCONFINED |
   161						    FLAG_ABS_ROOT);
 > 162		if (*seclen < 0)
   163			return -ENOMEM;
   164
   165		return 0;
   166	}
   167

Fixes: c092921219 ("apparmor: add support for mapping secids and using secctxes")
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2018-05-04 01:57:47 -07:00
parent 3107e8cb92
commit 52e7128ebb
1 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
security/apparmor/secid.c
View File

@ -142,6 +142,7 @@ int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
{
/* TODO: cache secctx and ref count so we don't have to recreate */
struct aa_label *label = aa_secid_to_label(secid);
int len;
AA_BUG(!secdata);
AA_BUG(!seclen);
@ -150,18 +151,19 @@ int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
return -EINVAL;
if (secdata)
*seclen = aa_label_asxprint(secdata, root_ns, label,
FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
FLAG_HIDDEN_UNCONFINED |
FLAG_ABS_ROOT, GFP_ATOMIC);
len = aa_label_asxprint(secdata, root_ns, label,
FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT,
GFP_ATOMIC);
else
*seclen = aa_label_snxprint(NULL, 0, root_ns, label,
FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
FLAG_HIDDEN_UNCONFINED |
FLAG_ABS_ROOT);
if (*seclen < 0)
len = aa_label_snxprint(NULL, 0, root_ns, label,
FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT);
if (len < 0)
return -ENOMEM;
*seclen = len;
return 0;
}