[PATCH] netlabel: cipso_v4: reject empty MLS level/cat lists and zero tail in cipso_v4_delopt()

[Hui Peng]

Fix three bugs in NetLabel CIPSOv4 handling:

1. In netlbl_cipsov4_add_std(), an empty NLBL_CIPSOV4_A_MLSLVLLST or
   NLBL_CIPSOV4_A_MLSCATLST leaves local_size or cipso_size at 0, causing
   kcalloc(0, ...) to return ZERO_SIZE_PTR (0x10), which bypasses NULL
   checks and installs ZERO_SIZE_PTR arrays into cipso_v4_doi_list. Reject
   0-sized level or category tables before allocation.
2. In netlbl_cipsov4_remove_cb(), also inspect NETLBL_NLTYPE_ADDRSELECT
   entries so IPv4 address-selected domain mappings referencing a removed
   CIPSOv4 DOI are properly cleaned up.
3. In cipso_v4_delopt(), zero the trailing cipso_len bytes with IPOPT_END
   after memmove() and pass opt->opt.optlen - cipso_len to
   cipso_v4_get_actual_opt_len() so stale tail bytes are not re-parsed.

Fixes: 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
Fixes: 389fb800ac8b ("netlabel: Label incoming TCP connections correctly in SELinux")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index a05aa075de1a..4ac1a4965abe 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -2025,9 +2025,11 @@ static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr)
 
 		memmove(cipso_ptr, cipso_ptr + cipso_len,
 			opt->opt.optlen - cipso_off - cipso_len);
+		memset(&opt->opt.__data[opt->opt.optlen - cipso_len],
+		       IPOPT_END, cipso_len);
 
 		optlen_new = cipso_v4_get_actual_opt_len(opt->opt.__data,
-							 opt->opt.optlen);
+							 opt->opt.optlen - cipso_len);
 		hdr_delta = opt->opt.optlen;
 		opt->opt.optlen = (optlen_new + 3) & ~3;
 		hdr_delta -= opt->opt.optlen;
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index b080e666523f..9bb28236b8fe 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -185,6 +185,9 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
 					break;
 				}
 		}
+	if (doi_def->map.std->lvl.local_size == 0 ||
+	    doi_def->map.std->lvl.cipso_size == 0)
+		goto add_std_failure;
 	doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
 					      sizeof(u32),
 					      GFP_KERNEL | __GFP_NOWARN);
@@ -260,6 +263,9 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
 						break;
 					}
 			}
+		if (doi_def->map.std->cat.local_size == 0 ||
+		    doi_def->map.std->cat.cipso_size == 0)
+			goto add_std_failure;
 		doi_def->map.std->cat.local = kcalloc(
 					      doi_def->map.std->cat.local_size,
 					      sizeof(u32),
@@ -680,10 +686,21 @@ static int netlbl_cipsov4_listall(struct sk_buff *skb,
 static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
 {
 	struct netlbl_domhsh_walk_arg *cb_arg = arg;
+	struct netlbl_af4list *iter4;
+	struct netlbl_domaddr4_map *map4;
 
 	if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 &&
 	    entry->def.cipso->doi == cb_arg->doi)
 		return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
+	else if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
+		netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) {
+			map4 = netlbl_domhsh_addr4_entry(iter4);
+			if (map4->def.type == NETLBL_NLTYPE_CIPSOV4 &&
+			    map4->def.cipso->doi == cb_arg->doi)
+				return netlbl_domhsh_remove_entry(entry,
+							cb_arg->audit_info);
+		}
+	}
 
 	return 0;
 }