1 files changed, 94 insertions, 42 deletions

diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 0aec318bf0ef..fff32b70efa9 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -43,6 +43,7 @@
 #include "netlabel_user.h"
 #include "netlabel_cipso_v4.h"
 #include "netlabel_mgmt.h"
+#include "netlabel_domainhash.h"
 
 /* Argument struct for cipso_v4_doi_walk() */
 struct netlbl_cipsov4_doiwalk_arg {
@@ -51,6 +52,12 @@ struct netlbl_cipsov4_doiwalk_arg {
         u32 seq;
 };
 
+/* Argument struct for netlbl_domhsh_walk() */
+struct netlbl_domhsh_walk_arg {
+        struct netlbl_audit *audit_info;
+        u32 doi;
+};
+
 /* NetLabel Generic NETLINK CIPSOv4 family */
 static struct genl_family netlbl_cipsov4_gnl_family = {
         .id = GENL_ID_GENERATE,
@@ -81,32 +88,6 @@ static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1
  */
 
 /**
- * netlbl_cipsov4_doi_free - Frees a CIPSO V4 DOI definition
- * @entry: the entry's RCU field
- *
- * Description:
- * This function is designed to be used as a callback to the call_rcu()
- * function so that the memory allocated to the DOI definition can be released
- * safely.
- *
- */
-void netlbl_cipsov4_doi_free(struct rcu_head *entry)
-{
-        struct cipso_v4_doi *ptr;
-
-        ptr = container_of(entry, struct cipso_v4_doi, rcu);
-        switch (ptr->type) {
-        case CIPSO_V4_MAP_STD:
-                kfree(ptr->map.std->lvl.cipso);
-                kfree(ptr->map.std->lvl.local);
-                kfree(ptr->map.std->cat.cipso);
-                kfree(ptr->map.std->cat.local);
-                break;
-        }
-        kfree(ptr);
-}
-
-/**
  * netlbl_cipsov4_add_common - Parse the common sections of a ADD message
  * @info: the Generic NETLINK info block
  * @doi_def: the CIPSO V4 DOI definition
@@ -151,9 +132,9 @@ static int netlbl_cipsov4_add_common(struct genl_info *info,
  * @info: the Generic NETLINK info block
  *
  * Description:
- * Create a new CIPSO_V4_MAP_STD DOI definition based on the given ADD message
- * and add it to the CIPSO V4 engine.  Return zero on success and non-zero on
- * error.
+ * Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD
+ * message and add it to the CIPSO V4 engine.  Return zero on success and
+ * non-zero on error.
  *
  */
 static int netlbl_cipsov4_add_std(struct genl_info *info)
@@ -183,7 +164,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info)
                 ret_val = -ENOMEM;
                 goto add_std_failure;
         }
-        doi_def->type = CIPSO_V4_MAP_STD;
+        doi_def->type = CIPSO_V4_MAP_TRANS;
 
         ret_val = netlbl_cipsov4_add_common(info, doi_def);
         if (ret_val != 0)
@@ -342,7 +323,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info)
 
 add_std_failure:
         if (doi_def)
-                netlbl_cipsov4_doi_free(&doi_def->rcu);
+                cipso_v4_doi_free(doi_def);
         return ret_val;
 }
 
@@ -379,7 +360,44 @@ static int netlbl_cipsov4_add_pass(struct genl_info *info)
         return 0;
 
 add_pass_failure:
-        netlbl_cipsov4_doi_free(&doi_def->rcu);
+        cipso_v4_doi_free(doi_def);
+        return ret_val;
+}
+
+/**
+ * netlbl_cipsov4_add_local - Adds a CIPSO V4 DOI definition
+ * @info: the Generic NETLINK info block
+ *
+ * Description:
+ * Create a new CIPSO_V4_MAP_LOCAL DOI definition based on the given ADD
+ * message and add it to the CIPSO V4 engine.  Return zero on success and
+ * non-zero on error.
+ *
+ */
+static int netlbl_cipsov4_add_local(struct genl_info *info)
+{
+        int ret_val;
+        struct cipso_v4_doi *doi_def = NULL;
+
+        if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
+                return -EINVAL;
+
+        doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
+        if (doi_def == NULL)
+                return -ENOMEM;
+        doi_def->type = CIPSO_V4_MAP_LOCAL;
+
+        ret_val = netlbl_cipsov4_add_common(info, doi_def);
+        if (ret_val != 0)
+                goto add_local_failure;
+
+        ret_val = cipso_v4_doi_add(doi_def);
+        if (ret_val != 0)
+                goto add_local_failure;
+        return 0;
+
+add_local_failure:
+        cipso_v4_doi_free(doi_def);
         return ret_val;
 }
 
@@ -412,14 +430,18 @@ static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
 
         type = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE]);
         switch (type) {
-        case CIPSO_V4_MAP_STD:
-                type_str = "std";
+        case CIPSO_V4_MAP_TRANS:
+                type_str = "trans";
                 ret_val = netlbl_cipsov4_add_std(info);
                 break;
         case CIPSO_V4_MAP_PASS:
                 type_str = "pass";
                 ret_val = netlbl_cipsov4_add_pass(info);
                 break;
+        case CIPSO_V4_MAP_LOCAL:
+                type_str = "local";
+                ret_val = netlbl_cipsov4_add_local(info);
+                break;
         }
         if (ret_val == 0)
                 atomic_inc(&netlabel_mgmt_protocount);
@@ -491,7 +513,7 @@ list_start:
         doi_def = cipso_v4_doi_getdef(doi);
         if (doi_def == NULL) {
                 ret_val = -EINVAL;
-                goto list_failure;
+                goto list_failure_lock;
         }
 
         ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type);
@@ -516,7 +538,7 @@ list_start:
         nla_nest_end(ans_skb, nla_a);
 
         switch (doi_def->type) {
-        case CIPSO_V4_MAP_STD:
+        case CIPSO_V4_MAP_TRANS:
                 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVLLST);
                 if (nla_a == NULL) {
                         ret_val = -ENOMEM;
@@ -655,7 +677,7 @@ static int netlbl_cipsov4_listall(struct sk_buff *skb,
                                   struct netlink_callback *cb)
 {
         struct netlbl_cipsov4_doiwalk_arg cb_arg;
-        int doi_skip = cb->args[0];
+        u32 doi_skip = cb->args[0];
 
         cb_arg.nl_cb = cb;
         cb_arg.skb = skb;
@@ -668,6 +690,29 @@ static int netlbl_cipsov4_listall(struct sk_buff *skb,
 }
 
 /**
+ * netlbl_cipsov4_remove_cb - netlbl_cipsov4_remove() callback for REMOVE
+ * @entry: LSM domain mapping entry
+ * @arg: the netlbl_domhsh_walk_arg structure
+ *
+ * Description:
+ * This function is intended for use by netlbl_cipsov4_remove() as the callback
+ * for the netlbl_domhsh_walk() function; it removes LSM domain map entries
+ * which are associated with the CIPSO DOI specified in @arg.  Returns zero on
+ * success, negative values on failure.
+ *
+ */
+static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
+{
+        struct netlbl_domhsh_walk_arg *cb_arg = arg;
+
+        if (entry->type == NETLBL_NLTYPE_CIPSOV4 &&
+            entry->type_def.cipsov4->doi == cb_arg->doi)
+                return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
+
+        return 0;
+}
+
+/**
  * netlbl_cipsov4_remove - Handle a REMOVE message
  * @skb: the NETLINK buffer
  * @info: the Generic NETLINK info block
@@ -681,8 +726,11 @@ static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
 {
         int ret_val = -EINVAL;
         u32 doi = 0;
+        struct netlbl_domhsh_walk_arg cb_arg;
         struct audit_buffer *audit_buf;
         struct netlbl_audit audit_info;
+        u32 skip_bkt = 0;
+        u32 skip_chain = 0;
 
         if (!info->attrs[NLBL_CIPSOV4_A_DOI])
                 return -EINVAL;
@@ -690,11 +738,15 @@ static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
         doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
         netlbl_netlink_auditinfo(skb, &audit_info);
 
-        ret_val = cipso_v4_doi_remove(doi,
-                                      &audit_info,
-                                      netlbl_cipsov4_doi_free);
-        if (ret_val == 0)
-                atomic_dec(&netlabel_mgmt_protocount);
+        cb_arg.doi = doi;
+        cb_arg.audit_info = &audit_info;
+        ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
+                                     netlbl_cipsov4_remove_cb, &cb_arg);
+        if (ret_val == 0 || ret_val == -ENOENT) {
+                ret_val = cipso_v4_doi_remove(doi, &audit_info);
+                if (ret_val == 0)
+                        atomic_dec(&netlabel_mgmt_protocount);
+        }
 
         audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_DEL,
                                               &audit_info);