Revert "selinux: reject a permission value exceeding the class permission count"

This reverts commit 9b46fba7528f58ca09eac67ec7d474ff1e9af066.

The stable pick applied the nprim bound after symtab_insert() because
the upstream context (the SEL_VEC_MAX check from commit 18fa21f10d00
"selinux: more strict policy parsing") does not exist in this tree.
On that error path perm_destroy() frees a key/datum pair that is
already linked into the symtab, leading to a double free when the
failed policydb is torn down.

Drop it here; it is re-applied later in this series in its upstream
form, after its strict-parsing prerequisite.

Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index fdb8a62da04ad82cf49cab3f3e932e955ce69c66..69c19ef4b881779319a784c873c0b0a984c839d8 100644 (file)
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -1168,9 +1168,6 @@ static int perm_read(struct policydb *p, struct symtab *s, struct policy_file *f
        rc = symtab_insert(s, key, perdatum);
        if (rc)
                goto bad;
-       /* indexes an nprim-sized array in security_get_permissions() */
-       if (perdatum->value > s->nprim)
-               goto bad;
 
        return 0;
 bad: