Messages in this thread | | | Subject | Re: [PATCH -next] selinux: Fix memleak in security_read_state_kernel | From | xiujianfeng <> | Date | Tue, 14 Jun 2022 21:34:53 +0800 |
| |
在 2022/6/14 20:57, Ondrej Mosnacek 写道: > On Mon, Jun 13, 2022 at 4:02 PM Xiu Jianfeng <xiujianfeng@huawei.com> wrote: >> In this function, it directly returns the result of __security_read_policy >> without freeing the allocated memory in *data, cause memory leak issue, >> so free the memory if __security_read_policy failed. >> >> Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> >> --- >> security/selinux/ss/services.c | 9 ++++++++- >> 1 file changed, 8 insertions(+), 1 deletion(-) >> >> diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c >> index 69b2734311a6..fe5fcf571c56 100644 >> --- a/security/selinux/ss/services.c >> +++ b/security/selinux/ss/services.c >> @@ -4048,6 +4048,7 @@ int security_read_policy(struct selinux_state *state, >> int security_read_state_kernel(struct selinux_state *state, >> void **data, size_t *len) >> { >> + int err; >> struct selinux_policy *policy; >> >> policy = rcu_dereference_protected( >> @@ -4060,5 +4061,11 @@ int security_read_state_kernel(struct selinux_state *state, >> if (!*data) >> return -ENOMEM; >> >> - return __security_read_policy(policy, *data, len); >> + err = __security_read_policy(policy, *data, len); >> + if (err) { >> + vfree(*data); >> + *data = NULL; >> + *len = 0; >> + } >> + return err; >> } >> -- >> 2.17.1 >> > security_read_policy() defined a few lines above has the same pattern > (just with vmalloc_user() in place of vmalloc()). Would you like to > send another patch to fix that function as well? No problem, patch already sent. >
| |