3

Author: XiaoTong6666

kernel/selinux/sepolicy.c

@@ -1218,34 +1218,55 @@ struct selinux_policy *ksu_dup_sepolicy(struct selinux_policy *old_pol)
 {
     int ret;
     size_t len;
+    size_t actual_len;
+    size_t alloc_len;
     struct selinux_policy *new_pol;
     void *data;
     struct policy_file fp;
+    int attempt;
 
     len = old_pol->policydb.len;
+    alloc_len = len;
     pr_info("sepolicy: duplicating live policy len=%zu\n", len);
-    data = vmalloc(len);
-    if (!data) {
-        pr_err("alloc policy len %ld\n", len);
-        ret = -ENOMEM;
-        goto out_free_data;
-    }
 
-    fp.data = data;
-    fp.len = len;
+    data = NULL;
+    for (attempt = 0; attempt < 4; attempt++) {
+        data = vmalloc(alloc_len);
+        if (!data) {
+            pr_err("alloc policy len %zu\n", alloc_len);
+            ret = -ENOMEM;
+            goto out_free_data;
+        }
 
-    ret = policydb_write(&old_pol->policydb, &fp);
-    if (ret) {
-        pr_err("sepolicy: policydb_write: %d\n", ret);
-        goto out_free_data;
+        fp.data = data;
+        fp.len = alloc_len;
+
+        ret = policydb_write(&old_pol->policydb, &fp);
+        if (!ret)
+            break;
+
+        kvfree(data);
+        data = NULL;
+
+        if (ret != -EINVAL || alloc_len > (SIZE_MAX >> 1)) {
+            pr_err("sepolicy: policydb_write: %d\n", ret);
+            goto out_free_data;
+        }
+
+        alloc_len <<= 1;
+        pr_warn("sepolicy: policydb_write buffer too small, retry with len=%zu\n", alloc_len);
     }
-    pr_info("sepolicy: policydb_write complete len=%zu\n", len);
+    if (ret)
+        goto out_free_data;
+
+    actual_len = (size_t)((unsigned long)fp.data - (unsigned long)data);
+    pr_info("sepolicy: policydb_write complete len=%zu alloc_len=%zu actual_len=%zu\n", len, alloc_len, actual_len);
 
     // https://android-review.googlesource.com/c/kernel/common/+/3009995/11/security/selinux/ss/policydb.c
     // fixup config
     // 4*2+8+4
     static const size_t kConfigOff = 20;
-    if (len >= kConfigOff + sizeof(u32)) {
+    if (actual_len >= kConfigOff + sizeof(u32)) {
         u32 *config_ptr = (u32 *)((unsigned long)data + kConfigOff);
         pr_info("old config: %u\n", *config_ptr);
         if (old_pol->policydb.android_netlink_route) {
@@ -1270,16 +1291,16 @@ struct selinux_policy *ksu_dup_sepolicy(struct selinux_policy *old_pol)
 
     // rewind fp
     fp.data = data;
-    fp.len = len;
+    fp.len = actual_len;
 
-    pr_info("sepolicy: policydb_read begin len=%zu\n", len);
+    pr_info("sepolicy: policydb_read begin len=%zu\n", actual_len);
     ret = policydb_read(&new_pol->policydb, &fp);
     if (ret) {
         pr_err("sepolicy: policydb_read: %d\n", ret);
         goto out_free_policydb;
     }
-    pr_info("sepolicy: policydb_read complete len=%zu\n", len);
-    new_pol->policydb.len = old_pol->policydb.len;
+    pr_info("sepolicy: policydb_read complete len=%zu\n", actual_len);
+    new_pol->policydb.len = actual_len;
     kvfree(data);
 
     return new_pol;