Commit a33e7ea0 authored by Tom Rix's avatar Tom Rix Committed by Kelsey Skunberg

selinux: fix double free

BugLink: https://bugs.launchpad.net/bugs/1885932

commit 65de5096 upstream.

Clang's static analysis tool reports these double free memory errors.

security/selinux/ss/services.c:2987:4: warning: Attempt to free released memory [unix.Malloc]
                        kfree(bnames[i]);
                        ^~~~~~~~~~~~~~~~
security/selinux/ss/services.c:2990:2: warning: Attempt to free released memory [unix.Malloc]
        kfree(bvalues);
        ^~~~~~~~~~~~~~

So improve the security_get_bools error handling by freeing these variables
and setting their return pointers to NULL and the return len to 0

Cc: stable@vger.kernel.org
Signed-off-by: default avatarTom Rix <trix@redhat.com>
Acked-by: default avatarStephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
Signed-off-by: default avatarKelsey Skunberg <kelsey.skunberg@canonical.com>
parent fd100533
...@@ -2622,8 +2622,12 @@ int security_get_bools(int *len, char ***names, int **values) ...@@ -2622,8 +2622,12 @@ int security_get_bools(int *len, char ***names, int **values)
if (*names) { if (*names) {
for (i = 0; i < *len; i++) for (i = 0; i < *len; i++)
kfree((*names)[i]); kfree((*names)[i]);
kfree(*names);
} }
kfree(*values); kfree(*values);
*len = 0;
*names = NULL;
*values = NULL;
goto out; goto out;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment