[PATCH] netlabel: calipso, x509: clean up ADDRSELECT on DOI removal and check AKID len

[sashiko-bot at kernel.org]

> Fix two issues in netlabel CALIPSO and X.509 key parsing:
> 
> 1. In netlbl_calipso_remove_cb() (net/netlabel/netlabel_calipso.c), also
>    inspect NETLBL_NLTYPE_ADDRSELECT entries so IPv6 address-selected
>    mappings referencing a removed CALIPSO DOI are removed.
> 2. In crypto/asymmetric_keys/x509_public_key.c, guard against zero-
>    length signature/AKID fields before key matching.
> 
> Fixes: cb72d38211ea ("netlabel: Initial support for the CALIPSO netlink protocol.")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike at gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919223438.3883567-1-benquike@gmail.com?part=1