Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
lsm: fix default return value for inode_getsecctx
commit b36995b upstream. -EOPNOTSUPP is the return value that implements a "no-op" hook, not 0. Without this fix having only the BPF LSM enabled (with no programs attached) can cause uninitialized variable reads in nfsd4_encode_fattr(), because the BPF hook returns 0 without touching the 'ctxlen' variable and the corresponding 'contextlen' variable in nfsd4_encode_fattr() remains uninitialized, yet being treated as valid based on the 0 return value. Cc: [email protected] Fixes: 98e828a ("security: Refactor declaration of LSM hooks") Reported-by: Benjamin Coddington <[email protected]> Signed-off-by: Ondrej Mosnacek <[email protected]> Signed-off-by: Paul Moore <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
- Loading branch information