diff options
| author | Gen Zhang <blackgod016574@gmail.com> | 2019-06-12 21:55:38 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-06-19 08:00:01 +0200 |
| commit | 6c729c9b9d42aaafc083907e280343fdb822bb60 (patch) | |
| tree | 5e47b1ca840fe377dfb89c85e67f5e445229e98d /security | |
| parent | ea9a004020c96178f1307019c689d5f588414850 (diff) | |
selinux: fix a missing-check bug in selinux_sb_eat_lsm_opts()
commit fec6375320c6399c708fa9801f8cfbf950fee623 upstream.
In selinux_sb_eat_lsm_opts(), 'arg' is allocated by kmemdup_nul(). It
returns NULL when fails. So 'arg' should be checked. And 'mnt_opts'
should be freed when error.
Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
Fixes: 99dbbb593fe6 ("selinux: rewrite selinux_sb_eat_lsm_opts()")
Cc: <stable@vger.kernel.org>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/selinux/hooks.c | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index d5feb2a0125d..614bc753822c 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2612,10 +2612,11 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts) char *from = options; char *to = options; bool first = true; + int rc; while (1) { int len = opt_len(from); - int token, rc; + int token; char *arg = NULL; token = match_opt_prefix(from, len, &arg); @@ -2631,15 +2632,15 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts) *q++ = c; } arg = kmemdup_nul(arg, q - arg, GFP_KERNEL); + if (!arg) { + rc = -ENOMEM; + goto free_opt; + } } rc = selinux_add_opt(token, arg, mnt_opts); if (unlikely(rc)) { kfree(arg); - if (*mnt_opts) { - selinux_free_mnt_opts(*mnt_opts); - *mnt_opts = NULL; - } - return rc; + goto free_opt; } } else { if (!first) { // copy with preceding comma @@ -2657,6 +2658,13 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts) } *to = '\0'; return 0; + +free_opt: + if (*mnt_opts) { + selinux_free_mnt_opts(*mnt_opts); + *mnt_opts = NULL; + } + return rc; } static int selinux_sb_remount(struct super_block *sb, void *mnt_opts) |