linux-kernel - Re: [PATCH RFC 5/6] selinux: unify OOM handling in network hashtables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4e6ec6918748074d1f081320eba38eda@paul-moore.com>
Date: Fri, 11 Apr 2025 16:29:37 -0400
From: Paul Moore <paul@...l-moore.com>
To: Christian Göttsche <cgoettsche@...tendoof.de>
Cc: Christian Göttsche <cgzones@...glemail.com>, Stephen Smalley <stephen.smalley.work@...il.com>, Ondrej Mosnacek <omosnace@...hat.com>, Thiébaud Weksteen <tweek@...gle.com>, Bram Bonné <brambonne@...gle.com>, Casey Schaufler <casey@...aufler-ca.com>, Canfeng Guo <guocanfeng@...ontech.com>, GUO Zihua <guozihua@...wei.com>, Chen Zhou <chenzhou10@...wei.com>, selinux@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH RFC 5/6] selinux: unify OOM handling in network hashtables

On Mar 18, 2025 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@...tendoof.de> wrote:
> 
> For network objects, like interfaces, nodes, port and InfiniBands, the
> object to SID lookup is cached in hashtables.  OOM during such hashtable
> additions of new objects is considered non-fatal and the computed SID is
> simply returned without adding the compute result into the hash table.
> 
> Actually ignore OOM in the InfiniBand code, despite the comment already
> suggesting to do so.  This reverts commit c350f8bea271 ("selinux: Fix
> error return code in sel_ib_pkey_sid_slow()").
> 
> Add comments in the other places.
> 
> Use kmalloc() instead of kzalloc(), since all members are initialized on
> success and the data is only used in internbal hash tables, so no risk
> of information leakage to userspace.
> 
> Fixes: c350f8bea271 ("selinux: Fix error return code in sel_ib_pkey_sid_slow()")
> Signed-off-by: Christian Göttsche <cgzones@...glemail.com>
> ---
>  security/selinux/ibpkey.c  | 11 +++++------
>  security/selinux/netif.c   |  6 +++++-
>  security/selinux/netnode.c |  5 ++++-
>  security/selinux/netport.c |  6 +++++-
>  4 files changed, 19 insertions(+), 9 deletions(-)

Merged into selinux/dev, thanks!

--
paul-moore.com