On Jun 19, 2026 Bradley Morgan <[email protected]> wrote: > > The lsm_get_self_attr() syscall allows callers to pass in a NULL context > buffer to find out the size of the output needed. That path still > compared the computed entry size against the caller provided size first, > so a NULL buffer with size 0 incorrectly returned -E2BIG rather than > reporting the required size. > > Only enforce the available buffer length after checking for the NULL > buffer. Cover the zero length sizing query in the self test. > > Fixes: d7cf3412a9f6 ("lsm: consolidate buffer size handling into > lsm_fill_user_ctx()") > Cc: [email protected] > Signed-off-by: Bradley Morgan <[email protected]> > --- > security/security.c | 8 ++++---- > tools/testing/selftests/lsm/lsm_get_self_attr_test.c | 5 ++--- > 2 files changed, 6 insertions(+), 7 deletions(-) > > diff --git a/security/security.c b/security/security.c > index 71aea8fdf014..fa0d7e036249 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -406,15 +406,15 @@ int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 > *uctx_len, > int rc = 0; > > nctx_len = ALIGN(struct_size(nctx, ctx, val_len), sizeof(void *)); > + /* no buffer - return success/0 and set @uctx_len to the req size */ > + if (!uctx) > + goto out; > + > if (nctx_len > *uctx_len) { > rc = -E2BIG; > goto out; > } > > - /* no buffer - return success/0 and set @uctx_len to the req size */ > - if (!uctx) > - goto out; > - > nctx = kzalloc(nctx_len, GFP_KERNEL); > if (nctx == NULL) { > rc = -ENOMEM;
I'm not sure the existing code is necessarily wrong. The existing code allows for an E2BIG length check against the current necessary size, so one can still do a length check regardless of if a buffer is passed. Even in the NULL/E2BIG case, the necessary buffer size should still be returned to the caller so that the process can size their allocation appropriately. Or am I missing something else? -- paul-moore.com
