linux-kernel - [GIT PULL] selinux: fix double free bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 13 Jun 2017 18:05:00 +1000 (AEST)
From:   James Morris <jmorris@...ei.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
cc:     linux-kernel@...r.kernel.org,
        linux-security-module@...r.kernel.org,
        Paul Moore <paul@...l-moore.com>
Subject: [GIT PULL] selinux: fix double free bug

Please pull this fix for a double free bug in SELinux.

The following changes since commit 63f700aab4c11d46626de3cd051dae56cf7e9056:

  Merge tag 'xtensa-20170612' of git://github.com/jcmvbkbc/linux-xtensa (2017-06-13 15:09:10 +0900)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git for-linus

Paul Moore (1):
      selinux: fix double free in selinux_parse_opts_str()

 security/selinux/hooks.c |    5 ++---
 1 files changed, 2 insertions(+), 3 deletions(-)

---

commit 023f108dcc187e34ef864bf10ed966cf25e14e2a
Author: Paul Moore <paul@...l-moore.com>
Date:   Wed Jun 7 16:48:19 2017 -0400

    selinux: fix double free in selinux_parse_opts_str()
    
    This patch is based on a discussion generated by an earlier patch
    from Tetsuo Handa:
    
    * https://marc.info/?t=149035659300001&r=1&w=2
    
    The double free problem involves the mnt_opts field of the
    security_mnt_opts struct, selinux_parse_opts_str() frees the memory
    on error, but doesn't set the field to NULL so if the caller later
    attempts to call security_free_mnt_opts() we trigger the problem.
    
    In order to play it safe we change selinux_parse_opts_str() to call
    security_free_mnt_opts() on error instead of free'ing the memory
    directly.  This should ensure that everything is handled correctly,
    regardless of what the caller may do.
    
    Fixes: e0007529893c1c06 ("LSM/SELinux: Interfaces to allow FS to control mount options")
    Cc: stable@...r.kernel.org
    Cc: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
    Reported-by: Dmitry Vyukov <dvyukov@...gle.com>
    Signed-off-by: Paul Moore <paul@...l-moore.com>
    Signed-off-by: James Morris <james.l.morris@...cle.com>

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e67a526..819fd68 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1106,10 +1106,8 @@ static int selinux_parse_opts_str(char *options,
 
 	opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
 				       GFP_KERNEL);
-	if (!opts->mnt_opts_flags) {
-		kfree(opts->mnt_opts);
+	if (!opts->mnt_opts_flags)
 		goto out_err;
-	}
 
 	if (fscontext) {
 		opts->mnt_opts[num_mnt_opts] = fscontext;
@@ -1132,6 +1130,7 @@ static int selinux_parse_opts_str(char *options,
 	return 0;
 
 out_err:
+	security_free_mnt_opts(opts);
 	kfree(context);
 	kfree(defcontext);
 	kfree(fscontext);