+/**
+ * append_ctx - append a lsm/context pair to a compound context
+ * @ctx: the existing compound context
+ * @ctxlen: size of the old context, including terminating nul byte
+ * @lsm: new lsm name, nul terminated
+ * @new: new context, possibly nul terminated
+ * @newlen: maximum size of @new
+ *
+ * replace @ctx with a new compound context, appending @newlsm and @new
+ * to @ctx. On exit the new data replaces the old, which is freed.
+ * @ctxlen is set to the new size, which includes a trailing nul byte.
+ *
+ * Returns 0 on success, -ENOMEM if no memory is available.
+ */
+static int append_ctx(char **ctx, int *ctxlen, const char *lsm, char *new,
+ int newlen)
+{
+ char *final;
+ size_t llen;
+ size_t nlen;
+ size_t flen;
+
+ llen = strlen(lsm) + 1;
+ /*
+ * A security module may or may not provide a trailing nul on
+ * when returning a security context. There is no definition
+ * of which it should be, and there are modules that do it
+ * each way.
+ */
+ nlen = strnlen(new, newlen);
+
+ flen = *ctxlen + llen + nlen + 1;
+ final = kzalloc(flen, GFP_KERNEL);
+
+ if (final == NULL)
+ return -ENOMEM;
+
+ if (*ctxlen)
+ memcpy(final, *ctx, *ctxlen);
+
+ memcpy(final + *ctxlen, lsm, llen);
+ memcpy(final + *ctxlen + llen, new, nlen);
+
+ kfree(*ctx);
+
+ *ctx = final;
+ *ctxlen = flen;
+
+ return 0;
+}
+