[PATCH 16/19] smack: smack_inode_notifysecctx(): reject invalid labels

[Konstantin Andreev]

Exactly the same issue as described in [1,2].

    smack_inode_notifysecctx()
    ` smack_inode_setsecurity
      ` smk_import_entry

uses an unsuitable parsing
function: smk_import_entry(), which acquires only
that part from the beginning of the input
that looks like a label.

[1] 2025-06-17 andreev
commit 674e2b24791c ("smack: fix bug: setting task label
                      silently ignores input garbage")
Link: https://lore.kernel.org/linux-security-module/20250315015723.1357541-3-andreev@swemel.ru/

[2] 2025-07 andreev
commit ("smack: fix bug: setting label-containing xattrs
         silently ignores input garbage")
Link: https://lore.kernel.org/linux-security-module/ae1100894499a1f6ce8e783727635388b3ac3af8.1753356770.git.andreev@swemel.ru/

Signed-off-by: Konstantin Andreev <andreev at swemel.ru>
---
 security/smack/smack_lsm.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 5175dfb3d448..9271cd54bc43 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -5003,11 +5003,17 @@ static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
 
 static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
 {
+	const struct smack_known *skp;
 	/*
 	 * UDS inode has fixed label. Ignore nfs label.
 	 */
 	if (S_ISSOCK(inode->i_mode))
 		return 0;
+
+	skp = smk_import_label(ctx, ctxlen);
+	if (IS_ERR(skp))
+		return PTR_ERR(skp);
+
 	return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx,
 				       ctxlen, 0);
 }
-- 
2.43.0