Commit ea9a0040 authored by Gen Zhang's avatar Gen Zhang Committed by Greg Kroah-Hartman

selinux: fix a missing-check bug in selinux_add_mnt_opt( )

commit e2e0e097 upstream.

In selinux_add_mnt_opt(), 'val' is allocated by kmemdup_nul(). It returns
NULL when fails. So 'val' should be checked. And 'mnt_opts' should be
freed when error.
Signed-off-by: default avatarGen Zhang <blackgod016574@gmail.com>
Fixes: 757cbe59 ("LSM: new method: ->sb_add_mnt_opt()")
Cc: <stable@vger.kernel.org>
[PM: fixed some indenting problems]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent bc690120
...@@ -1048,15 +1048,24 @@ static int selinux_add_mnt_opt(const char *option, const char *val, int len, ...@@ -1048,15 +1048,24 @@ static int selinux_add_mnt_opt(const char *option, const char *val, int len,
if (token == Opt_error) if (token == Opt_error)
return -EINVAL; return -EINVAL;
if (token != Opt_seclabel) if (token != Opt_seclabel) {
val = kmemdup_nul(val, len, GFP_KERNEL); val = kmemdup_nul(val, len, GFP_KERNEL);
if (!val) {
rc = -ENOMEM;
goto free_opt;
}
}
rc = selinux_add_opt(token, val, mnt_opts); rc = selinux_add_opt(token, val, mnt_opts);
if (unlikely(rc)) { if (unlikely(rc)) {
kfree(val); kfree(val);
if (*mnt_opts) { goto free_opt;
selinux_free_mnt_opts(*mnt_opts); }
*mnt_opts = NULL; return rc;
}
free_opt:
if (*mnt_opts) {
selinux_free_mnt_opts(*mnt_opts);
*mnt_opts = NULL;
} }
return rc; return rc;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment