Messages in this thread | | | Subject | Re: [PATCH] selinux: fix NULL dereference in policydb_destroy() | From | Stephen Smalley <> | Date | Mon, 18 Mar 2019 09:42:52 -0400 |
| |
On 3/17/19 9:46 AM, Ondrej Mosnacek wrote: > The conversion to kvmalloc() forgot to account for the possibility that > p->type_attr_map_array might be null in policydb_destroy(). > > Fix this by destroying its contents only if it is not NULL. > > Also make sure ebitmap_init() is called on all entries before > policydb_destroy() can be called. Right now this is a no-op, because > both kvcalloc() and ebitmap_init() just zero out the whole struct, but > let's rather not rely on a specific implementation. > > Reported-by: syzbot+a57b2aff60832666fc28@syzkaller.appspotmail.com > Fixes: acdf52d97f82 ("selinux: convert to kvmalloc") > Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
> --- > security/selinux/ss/policydb.c | 13 +++++++++---- > 1 file changed, 9 insertions(+), 4 deletions(-) > > NOTE: This applies directly on top of current Linus' tree, since the > problematic commit is not present in the selinux/stable-5.1 branch. > > diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c > index 6b576e588725..daecdfb15a9c 100644 > --- a/security/selinux/ss/policydb.c > +++ b/security/selinux/ss/policydb.c > @@ -828,9 +828,11 @@ void policydb_destroy(struct policydb *p) > hashtab_map(p->range_tr, range_tr_destroy, NULL); > hashtab_destroy(p->range_tr); > > - for (i = 0; i < p->p_types.nprim; i++) > - ebitmap_destroy(&p->type_attr_map_array[i]); > - kvfree(p->type_attr_map_array); > + if (p->type_attr_map_array) { > + for (i = 0; i < p->p_types.nprim; i++) > + ebitmap_destroy(&p->type_attr_map_array[i]); > + kvfree(p->type_attr_map_array); > + } > > ebitmap_destroy(&p->filename_trans_ttypes); > ebitmap_destroy(&p->policycaps); > @@ -2496,10 +2498,13 @@ int policydb_read(struct policydb *p, void *fp) > if (!p->type_attr_map_array) > goto bad; > > + /* just in case ebitmap_init() becomes more than just a memset(0): */ > + for (i = 0; i < p->p_types.nprim; i++) > + ebitmap_init(&p->type_attr_map_array[i]); > + > for (i = 0; i < p->p_types.nprim; i++) { > struct ebitmap *e = &p->type_attr_map_array[i]; > > - ebitmap_init(e); > if (p->policyvers >= POLICYDB_VERSION_AVTAB) { > rc = ebitmap_read(e, fp); > if (rc) >
| |