Messages in this thread Patch in this message | | | From | trix@redhat ... | Subject | [PATCH v2 1/1] selinux: fix another double free | Date | Thu, 11 Jun 2020 13:47:46 -0700 |
| |
From: Tom Rix <trix@redhat.com>
Clang static analysis reports this double free error
security/selinux/ss/conditional.c:139:2: warning: Attempt to free released memory [unix.Malloc] kfree(node->expr.nodes); ^~~~~~~~~~~~~~~~~~~~~~~
When cond_read_node fails, it calls cond_node_destroy which frees the node but does not poison the entry in the node list. So when it returns to its caller cond_read_list, cond_read_list deletes the partial list. The latest entry in the list will be deleted twice.
So instead of freeing the node in cond_read_node, let list freeing in code_read_list handle the freeing the problem node along with all of the earlier nodes.
Because cond_read_node no longer does any error handling, the goto's the error case are redundant. Instead just return the error code.
Fixes a problem was introduced by commit
selinux: convert cond_list to array
Signed-off-by: Tom Rix <trix@redhat.com> --- security/selinux/ss/conditional.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index da94a1b4bfda..d0d6668709f0 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c @@ -392,26 +392,21 @@ static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp) rc = next_entry(buf, fp, sizeof(u32) * 2); if (rc) - goto err; + return rc; expr->expr_type = le32_to_cpu(buf[0]); expr->bool = le32_to_cpu(buf[1]); if (!expr_node_isvalid(p, expr)) { rc = -EINVAL; - goto err; + return rc; } } rc = cond_read_av_list(p, fp, &node->true_list, NULL); if (rc) - goto err; + return rc; rc = cond_read_av_list(p, fp, &node->false_list, &node->true_list); - if (rc) - goto err; - return 0; -err: - cond_node_destroy(node); return rc; } -- 2.18.1
| |