lkml.org 
[lkml]   [2008]   [Jan]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [2.6 patch] security/selinux/netlabel.c: fix double free
    Date
    On Monday 28 January 2008 5:09:38 pm Adrian Bunk wrote:
    > This patch fixes a double free (security_netlbl_sid_to_secattr()
    > already calls netlbl_secattr_destroy() when it returns !0) introduced
    > by commit 45c950e0f839fded922ebc0bfd59b1081cc71b70 and spotted by the
    > Coverity checker.

    Hi Adrian,

    Thanks for finding this mistake, however, I'd rather see it fixed by
    removing the netlbl_secattr_destroy() call in
    security_netlbl_sid_to_secattr() as it really shouldn't be there
    anymore. We moved the matching _init() call into
    selinux_netlbl_sock_setsid() and I'd like to see the _init() and
    _destroy() calls done in the same function. I can push a revised patch
    for this if you would prefer, otherwise I'll be happy to ack an updated
    version ...

    > Signed-off-by: Adrian Bunk <bunk@kernel.org>
    >
    > ---
    > --- linux-2.6/security/selinux/netlabel.c.old 2008-01-23
    > 00:38:19.000000000 +0200 +++
    > linux-2.6/security/selinux/netlabel.c 2008-01-23 00:39:09.000000000
    > +0200 @@ -58,22 +58,22 @@ static int selinux_netlbl_sock_setsid(st rc
    > = security_netlbl_sid_to_secattr(sid, &secattr);
    > if (rc != 0)
    > goto sock_setsid_return;
    > rc = netlbl_sock_setattr(sk, &secattr);
    > if (rc == 0) {
    > spin_lock_bh(&sksec->nlbl_lock);
    > sksec->nlbl_state = NLBL_LABELED;
    > spin_unlock_bh(&sksec->nlbl_lock);
    > }
    >
    > -sock_setsid_return:
    > netlbl_secattr_destroy(&secattr);
    > +sock_setsid_return:
    > return rc;
    > }
    >
    > /**
    > * selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache
    > *
    > * Description:
    > * Invalidate the NetLabel security attribute mapping cache.
    > *
    > */



    --
    paul moore
    linux security @ hp


    \
     
     \ /
      Last update: 2008-01-28 23:27    [W:0.032 / U:0.056 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site