lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 23 Jun 2020 21:58:25 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-kernel@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, stable@...r.kernel.org, Tom Rix <trix@...hat.com>, Stephen Smalley <stephen.smalley.work@...il.com>, Paul Moore <paul@...l-moore.com> Subject: [PATCH 4.19 177/206] selinux: fix double free From: Tom Rix <trix@...hat.com> commit 65de50969a77509452ae590e9449b70a22b923bb upstream. Clang's static analysis tool reports these double free memory errors. security/selinux/ss/services.c:2987:4: warning: Attempt to free released memory [unix.Malloc] kfree(bnames[i]); ^~~~~~~~~~~~~~~~ security/selinux/ss/services.c:2990:2: warning: Attempt to free released memory [unix.Malloc] kfree(bvalues); ^~~~~~~~~~~~~~ So improve the security_get_bools error handling by freeing these variables and setting their return pointers to NULL and the return len to 0 Cc: stable@...r.kernel.org Signed-off-by: Tom Rix <trix@...hat.com> Acked-by: Stephen Smalley <stephen.smalley.work@...il.com> Signed-off-by: Paul Moore <paul@...l-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org> --- security/selinux/ss/services.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -2857,8 +2857,12 @@ err: if (*names) { for (i = 0; i < *len; i++) kfree((*names)[i]); + kfree(*names); } kfree(*values); + *len = 0; + *names = NULL; + *values = NULL; goto out; }
Powered by blists - more mailing lists