Merge tag 'selinux-pr-20190612' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux

Pull selinux fixes from Paul Moore:
 "Three patches for v5.2.

  One fixes a problem where we weren't correctly logging raw SELinux
  labels, the other two fix problems where we weren't properly checking
  calls to kmemdup()"

* tag 'selinux-pr-20190612' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: fix a missing-check bug in selinux_sb_eat_lsm_opts()
  selinux: fix a missing-check bug in selinux_add_mnt_opt( )
  selinux: log raw contexts as untrusted strings

2 files changed, 36 insertions, 13 deletions

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 8346a4f7c5d7..a99be508f93d 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -739,14 +739,20 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
         rc = security_sid_to_context_inval(sad->state, sad->ssid, &scontext,
                                            &scontext_len);
         if (!rc && scontext) {
-                audit_log_format(ab, " srawcon=%s", scontext);
+                if (scontext_len && scontext[scontext_len - 1] == '\0')
+                        scontext_len--;
+                audit_log_format(ab, " srawcon=");
+                audit_log_n_untrustedstring(ab, scontext, scontext_len);
                 kfree(scontext);
         }
 
         rc = security_sid_to_context_inval(sad->state, sad->tsid, &scontext,
                                            &scontext_len);
         if (!rc && scontext) {
-                audit_log_format(ab, " trawcon=%s", scontext);
+                if (scontext_len && scontext[scontext_len - 1] == '\0')
+                        scontext_len--;
+                audit_log_format(ab, " trawcon=");
+                audit_log_n_untrustedstring(ab, scontext, scontext_len);
                 kfree(scontext);
         }
 }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3ec702cf46ca..fea66f6b31bf 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1052,15 +1052,24 @@ static int selinux_add_mnt_opt(const char *option, const char *val, int len,
         if (token == Opt_error)
                 return -EINVAL;
 
-        if (token != Opt_seclabel)
+        if (token != Opt_seclabel) {
                 val = kmemdup_nul(val, len, GFP_KERNEL);
+                if (!val) {
+                        rc = -ENOMEM;
+                        goto free_opt;
+                }
+        }
         rc = selinux_add_opt(token, val, mnt_opts);
         if (unlikely(rc)) {
                 kfree(val);
-                if (*mnt_opts) {
-                        selinux_free_mnt_opts(*mnt_opts);
-                        *mnt_opts = NULL;
-                }
+                goto free_opt;
+        }
+        return rc;
+
+free_opt:
+        if (*mnt_opts) {
+                selinux_free_mnt_opts(*mnt_opts);
+                *mnt_opts = NULL;
         }
         return rc;
 }
@@ -2616,10 +2625,11 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
         char *from = options;
         char *to = options;
         bool first = true;
+        int rc;
 
         while (1) {
                 int len = opt_len(from);
-                int token, rc;
+                int token;
                 char *arg = NULL;
 
                 token = match_opt_prefix(from, len, &arg);
@@ -2635,15 +2645,15 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
                                                 *q++ = c;
                                 }
                                 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
+                                if (!arg) {
+                                        rc = -ENOMEM;
+                                        goto free_opt;
+                                }
                         }
                         rc = selinux_add_opt(token, arg, mnt_opts);
                         if (unlikely(rc)) {
                                 kfree(arg);
-                                if (*mnt_opts) {
-                                        selinux_free_mnt_opts(*mnt_opts);
-                                        *mnt_opts = NULL;
-                                }
-                                return rc;
+                                goto free_opt;
                         }
                 } else {
                         if (!first) {   // copy with preceding comma
@@ -2661,6 +2671,13 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
         }
         *to = '\0';
         return 0;
+
+free_opt:
+        if (*mnt_opts) {
+                selinux_free_mnt_opts(*mnt_opts);
+                *mnt_opts = NULL;
+        }
+        return rc;
 }
 
 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)