4 files changed, 27 insertions, 19 deletions

diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
index 30f119b1d1ec..820313a04d49 100644
--- a/security/selinux/ss/ebitmap.c
+++ b/security/selinux/ss/ebitmap.c
@@ -213,7 +213,12 @@ netlbl_import_failure:
 }
 #endif /* CONFIG_NETLABEL */
 
-int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2)
+/*
+ * Check to see if all the bits set in e2 are also set in e1. Optionally,
+ * if last_e2bit is non-zero, the highest set bit in e2 cannot exceed
+ * last_e2bit.
+ */
+int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit)
 {
         struct ebitmap_node *n1, *n2;
         int i;
@@ -223,14 +228,25 @@ int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2)
 
         n1 = e1->node;
         n2 = e2->node;
+
         while (n1 && n2 && (n1->startbit <= n2->startbit)) {
                 if (n1->startbit < n2->startbit) {
                         n1 = n1->next;
                         continue;
                 }
-                for (i = 0; i < EBITMAP_UNIT_NUMS; i++) {
+                for (i = EBITMAP_UNIT_NUMS - 1; (i >= 0) && !n2->maps[i]; )
+                        i--;    /* Skip trailing NULL map entries */
+                if (last_e2bit && (i >= 0)) {
+                        u32 lastsetbit = n2->startbit + i * EBITMAP_UNIT_SIZE +
+                                         __fls(n2->maps[i]);
+                        if (lastsetbit > last_e2bit)
+                                return 0;
+                }
+
+                while (i >= 0) {
                         if ((n1->maps[i] & n2->maps[i]) != n2->maps[i])
                                 return 0;
+                        i--;
                 }
 
                 n1 = n1->next;
diff --git a/security/selinux/ss/ebitmap.h b/security/selinux/ss/ebitmap.h
index 922f8afa89dd..e7eb3a9c5ab7 100644
--- a/security/selinux/ss/ebitmap.h
+++ b/security/selinux/ss/ebitmap.h
@@ -117,7 +117,7 @@ static inline void ebitmap_node_clr_bit(struct ebitmap_node *n,
 
 int ebitmap_cmp(struct ebitmap *e1, struct ebitmap *e2);
 int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src);
-int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2);
+int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit);
 int ebitmap_get_bit(struct ebitmap *e, unsigned long bit);
 int ebitmap_set_bit(struct ebitmap *e, unsigned long bit, int value);
 void ebitmap_destroy(struct ebitmap *e);
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index 40de8d3f208e..c85bc1ec040c 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -160,8 +160,6 @@ void mls_sid_to_context(struct context *context,
 int mls_level_isvalid(struct policydb *p, struct mls_level *l)
 {
         struct level_datum *levdatum;
-        struct ebitmap_node *node;
-        int i;
 
         if (!l->sens || l->sens > p->p_levels.nprim)
                 return 0;
@@ -170,19 +168,13 @@ int mls_level_isvalid(struct policydb *p, struct mls_level *l)
         if (!levdatum)
                 return 0;
 
-        ebitmap_for_each_positive_bit(&l->cat, node, i) {
-                if (i > p->p_cats.nprim)
-                        return 0;
-                if (!ebitmap_get_bit(&levdatum->level->cat, i)) {
-                        /*
-                         * Category may not be associated with
-                         * sensitivity.
-                         */
-                        return 0;
-                }
-        }
-
-        return 1;
+        /*
+         * Return 1 iff all the bits set in l->cat are also be set in
+         * levdatum->level->cat and no bit in l->cat is larger than
+         * p->p_cats.nprim.
+         */
+        return ebitmap_contains(&levdatum->level->cat, &l->cat,
+                                p->p_cats.nprim);
 }
 
 int mls_range_isvalid(struct policydb *p, struct mls_range *r)
diff --git a/security/selinux/ss/mls_types.h b/security/selinux/ss/mls_types.h
index 03bed52a8052..e93648774137 100644
--- a/security/selinux/ss/mls_types.h
+++ b/security/selinux/ss/mls_types.h
@@ -35,7 +35,7 @@ static inline int mls_level_eq(struct mls_level *l1, struct mls_level *l2)
 static inline int mls_level_dom(struct mls_level *l1, struct mls_level *l2)
 {
         return ((l1->sens >= l2->sens) &&
-                ebitmap_contains(&l1->cat, &l2->cat));
+                ebitmap_contains(&l1->cat, &l2->cat, 0));
 }
 
 #define mls_level_incomp(l1, l2) \