| Message ID | 20200610215713.5319-2-trix@redhat.com (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | selinux: fix double free | expand |
On Wed, Jun 10, 2020 at 5:57 PM <trix@redhat.com> wrote: > > From: Tom Rix <trix@redhat.com> > > Clang's static analysis tool reports these double free memory errors. > > security/selinux/ss/services.c:2987:4: warning: Attempt to free released memory [unix.Malloc] > kfree(bnames[i]); > ^~~~~~~~~~~~~~~~ > security/selinux/ss/services.c:2990:2: warning: Attempt to free released memory [unix.Malloc] > kfree(bvalues); > ^~~~~~~~~~~~~~ > > So improve the security_get_bools error handling by freeing these variables > and setting their return pointers to NULL and the return len to 0 > > Signed-off-by: Tom Rix <trix@redhat.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
On Wed, Jun 10, 2020 at 5:57 PM <trix@redhat.com> wrote: > From: Tom Rix <trix@redhat.com> > > Clang's static analysis tool reports these double free memory errors. > > security/selinux/ss/services.c:2987:4: warning: Attempt to free released memory [unix.Malloc] > kfree(bnames[i]); > ^~~~~~~~~~~~~~~~ > security/selinux/ss/services.c:2990:2: warning: Attempt to free released memory [unix.Malloc] > kfree(bvalues); > ^~~~~~~~~~~~~~ > > So improve the security_get_bools error handling by freeing these variables > and setting their return pointers to NULL and the return len to 0 > > Signed-off-by: Tom Rix <trix@redhat.com> > --- > security/selinux/ss/services.c | 4 ++++ > 1 file changed, 4 insertions(+) Thanks Tom for the patch and Stephen for the review. I've marked this for stable and merged it into selinux/stable-5.8. Considering we are just a few days away from the close of the merge window and -rc1, I'll probably hold off until next to send this up to Linus. > diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c > index 313919bd42f8..ef0afd878bfc 100644 > --- a/security/selinux/ss/services.c > +++ b/security/selinux/ss/services.c > @@ -2888,8 +2888,12 @@ int security_get_bools(struct selinux_state *state, > if (*names) { > for (i = 0; i < *len; i++) > kfree((*names)[i]); > + kfree(*names); > } > kfree(*values); > + *len = 0; > + *names = NULL; > + *values = NULL; > goto out; > } > > -- > 2.18.1
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 313919bd42f8..ef0afd878bfc 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -2888,8 +2888,12 @@ int security_get_bools(struct selinux_state *state, if (*names) { for (i = 0; i < *len; i++) kfree((*names)[i]); + kfree(*names); } kfree(*values); + *len = 0; + *names = NULL; + *values = NULL; goto out; }