From: Gen Zhang blackgod016574@gmail.com
commit fec6375320c6399c708fa9801f8cfbf950fee623 upstream.
In selinux_sb_eat_lsm_opts(), 'arg' is allocated by kmemdup_nul(). It returns NULL when fails. So 'arg' should be checked. And 'mnt_opts' should be freed when error.
Signed-off-by: Gen Zhang blackgod016574@gmail.com Fixes: 99dbbb593fe6 ("selinux: rewrite selinux_sb_eat_lsm_opts()") Cc: stable@vger.kernel.org Signed-off-by: Paul Moore paul@paul-moore.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- security/selinux/hooks.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
--- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2612,10 +2612,11 @@ static int selinux_sb_eat_lsm_opts(char char *from = options; char *to = options; bool first = true; + int rc;
while (1) { int len = opt_len(from); - int token, rc; + int token; char *arg = NULL;
token = match_opt_prefix(from, len, &arg); @@ -2631,15 +2632,15 @@ static int selinux_sb_eat_lsm_opts(char *q++ = c; } arg = kmemdup_nul(arg, q - arg, GFP_KERNEL); + if (!arg) { + rc = -ENOMEM; + goto free_opt; + } } rc = selinux_add_opt(token, arg, mnt_opts); if (unlikely(rc)) { kfree(arg); - if (*mnt_opts) { - selinux_free_mnt_opts(*mnt_opts); - *mnt_opts = NULL; - } - return rc; + goto free_opt; } } else { if (!first) { // copy with preceding comma @@ -2657,6 +2658,13 @@ static int selinux_sb_eat_lsm_opts(char } *to = '\0'; return 0; + +free_opt: + if (*mnt_opts) { + selinux_free_mnt_opts(*mnt_opts); + *mnt_opts = NULL; + } + return rc; }
static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)