[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 2 Feb 2022 12:25:11 +0100
From: vbendel@...hat.com
To: paul@...l-moore.com, stephen.smalley.work@...il.com,
eparis@...isplace.org
Cc: omosnace@...hat.com, selinux@...r.kernel.org,
linux-kernel@...r.kernel.org, Vratislav Bendel <vbendel@...hat.com>
Subject: [PATCH v2] selinux: fix double free of cond_list on error paths
From: Vratislav Bendel <vbendel@...hat.com>
On error path from cond_read_list() and duplicate_policydb_cond_list()
the cond_list_destroy() gets called a second time in caller functions,
resulting in NULL pointer deref.
Fix this by resetting the cond_list_len to 0 in cond_list_destroy(),
making subsequent calls a noop.
Also consistently reset the cond_list pointer to NULL after freeing.
Signed-off-by: Vratislav Bendel <vbendel@...hat.com>
---
security/selinux/ss/conditional.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index 2ec6e5cd25d9..feb206f3acb4 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -152,6 +152,8 @@ static void cond_list_destroy(struct policydb *p)
for (i = 0; i < p->cond_list_len; i++)
cond_node_destroy(&p->cond_list[i]);
kfree(p->cond_list);
+ p->cond_list = NULL;
+ p->cond_list_len = 0;
}
void cond_policydb_destroy(struct policydb *p)
@@ -441,7 +443,6 @@ int cond_read_list(struct policydb *p, void *fp)
return 0;
err:
cond_list_destroy(p);
- p->cond_list = NULL;
return rc;
}
--
2.26.3
Powered by blists - more mailing lists