[PATCH] SELinux - handle sel_make_bools() failure in selinuxfs

[James Morris]

This patch fixes error handling in sel_make_bools(), where currently we'd 
get a memory leak via security_get_bools() and try to kfree() the wrong 
pointer if called again.

Please apply.

Author: Davi Arnaut <davi.arnaut@xxxxxxxxx>
Signed-off-by: James Morris <jmorris@xxxxxxxxx>
Acked-by: Stephen Smalley <sds@xxxxxxxxxxxxx>

---

 security/selinux/selinuxfs.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -879,7 +879,7 @@ static ssize_t sel_commit_bools_write(st
 	if (sscanf(page, "%d", &new_value) != 1)
 		goto out;

-	if (new_value) {
+	if (new_value && bool_pending_values) {
 		security_set_bools(bool_num, bool_pending_values);
 	}

@@ -952,6 +952,7 @@ static int sel_make_bools(void)

 	/* remove any existing files */
 	kfree(bool_pending_values);
+	bool_pending_values = NULL;

 	sel_remove_bools(dir);

@@ -1002,6 +1003,7 @@ out:
 	}
 	return ret;
 err:
+	kfree(values);
 	d_genocide(dir);
 	ret = -ENOMEM;
 	goto out;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/