Smack: prevent underflow in smk_set_cipso()

We have an upper bound on "maplevel" but forgot to check for negative values. Fixes: e114e47 ("Smack: Simplified Mandatory Access Control Kernel") Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Casey Schaufler <[email protected]>
0day-ci · Jul 27, 2020 · 42a2df3 · 42a2df3
1 parent a6bd4f6
commit 42a2df3
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
@@ -884,7 +884,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
 	}
 
 	ret = sscanf(rule, "%d", &maplevel);
-	if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
+	if (ret != 1 || maplevel < 0 || maplevel > SMACK_CIPSO_MAXLEVEL)
 		goto out;
 
 	rule += SMK_DIGITLEN;