AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-11-24 12:50:52 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

selinux: fix a missing-check bug in selinux_sb_eat_lsm_opts()

Browse Source 
In selinux_sb_eat_lsm_opts(), 'arg' is allocated by kmemdup_nul(). It
returns NULL when fails. So 'arg' should be checked. And 'mnt_opts'
should be freed when error.

Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
Fixes: 99dbbb593f ("selinux: rewrite selinux_sb_eat_lsm_opts()")
Cc: <stable@vger.kernel.org>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Gen Zhang 2019-06-12 21:55:38 +08:00 committed by Paul Moore
parent e2e0e09758
commit fec6375320
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
security/selinux/hooks.c
View File

@ -2625,10 +2625,11 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
char *from = options; char *from = options;
char *to = options; char *to = options;
bool first = true; bool first = true;
int rc;
while (1) { while (1) {
int len = opt_len(from); int len = opt_len(from);
int token, rc; int token;
char *arg = NULL; char *arg = NULL;
token = match_opt_prefix(from, len, &arg); token = match_opt_prefix(from, len, &arg);
@ -2644,15 +2645,15 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
*q++ = c; *q++ = c;
} }
arg = kmemdup_nul(arg, q - arg, GFP_KERNEL); arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
if (!arg) {
rc = -ENOMEM;
goto free_opt;
}
} }
rc = selinux_add_opt(token, arg, mnt_opts); rc = selinux_add_opt(token, arg, mnt_opts);
if (unlikely(rc)) { if (unlikely(rc)) {
kfree(arg); kfree(arg);
if (*mnt_opts) { goto free_opt;
selinux_free_mnt_opts(*mnt_opts);
*mnt_opts = NULL;
}
return rc;
} }
} else { } else {
if (!first) { // copy with preceding comma if (!first) { // copy with preceding comma
@ -2670,6 +2671,13 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
} }
*to = '\0'; *to = '\0';
return 0; return 0;
free_opt:
if (*mnt_opts) {
selinux_free_mnt_opts(*mnt_opts);
*mnt_opts = NULL;
}
return rc;
} }
static int selinux_sb_remount(struct super_block *sb, void *mnt_opts) static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)