lkml.org 
[lkml]   [2017]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 189/233] selinux: fix double free in selinux_parse_opts_str()
    3.16.48-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Paul Moore <paul@paul-moore.com>

    commit 023f108dcc187e34ef864bf10ed966cf25e14e2a upstream.

    This patch is based on a discussion generated by an earlier patch
    from Tetsuo Handa:

    * https://marc.info/?t=149035659300001&r=1&w=2

    The double free problem involves the mnt_opts field of the
    security_mnt_opts struct, selinux_parse_opts_str() frees the memory
    on error, but doesn't set the field to NULL so if the caller later
    attempts to call security_free_mnt_opts() we trigger the problem.

    In order to play it safe we change selinux_parse_opts_str() to call
    security_free_mnt_opts() on error instead of free'ing the memory
    directly. This should ensure that everything is handled correctly,
    regardless of what the caller may do.

    Fixes: e0007529893c1c06 ("LSM/SELinux: Interfaces to allow FS to control mount options")
    Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: James Morris <james.l.morris@oracle.com>
    [bwh: Backported to 3.16: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    security/selinux/hooks.c | 5 ++---
    1 file changed, 2 insertions(+), 3 deletions(-)

    --- a/security/selinux/hooks.c
    +++ b/security/selinux/hooks.c
    @@ -1000,10 +1000,8 @@ static int selinux_parse_opts_str(char *
    goto out_err;

    opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
    - if (!opts->mnt_opts_flags) {
    - kfree(opts->mnt_opts);
    + if (!opts->mnt_opts_flags)
    goto out_err;
    - }

    if (fscontext) {
    opts->mnt_opts[num_mnt_opts] = fscontext;
    @@ -1026,6 +1024,7 @@ static int selinux_parse_opts_str(char *
    return 0;

    out_err:
    + security_free_mnt_opts(opts);
    kfree(context);
    kfree(defcontext);
    kfree(fscontext);
    \
     
     \ /
      Last update: 2017-09-10 01:08    [W:2.047 / U:0.300 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site