From: Wentao Guan Date: Thu, 27 Aug 2026 18:06:02 +0000 (+0800) Subject: Revert "selinux: reject a permission value exceeding the class permission count" X-Git-Url: http://git.hungrycats.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=71ecdc1ba07fde972d72a182e21d3aab0fd4e36b;p=linux Revert "selinux: reject a permission value exceeding the class permission count" This reverts commit 9b46fba7528f58ca09eac67ec7d474ff1e9af066. The stable pick applied the nprim bound after symtab_insert() because the upstream context (the SEL_VEC_MAX check from commit 18fa21f10d00 "selinux: more strict policy parsing") does not exist in this tree. On that error path perm_destroy() frees a key/datum pair that is already linked into the symtab, leading to a double free when the failed policydb is torn down. Drop it here; it is re-applied later in this series in its upstream form, after its strict-parsing prerequisite. Signed-off-by: Wentao Guan Signed-off-by: Sasha Levin --- diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index fdb8a62da04ad..69c19ef4b8817 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -1168,9 +1168,6 @@ static int perm_read(struct policydb *p, struct symtab *s, struct policy_file *f rc = symtab_insert(s, key, perdatum); if (rc) goto bad; - /* indexes an nprim-sized array in security_get_permissions() */ - if (perdatum->value > s->nprim) - goto bad; return 0; bad: