Commit 314dabb8 authored by James Morris's avatar James Morris

SELinux: fix memory leakage in /security/selinux/hooks.c

Fix memory leakage in /security/selinux/hooks.c

The buffer always needs to be freed here; we either error
out or allocate more memory.
Reported-by: default avatariceberg <strakh@ispras.ru>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
parent 85dfd81d
...@@ -1285,6 +1285,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent ...@@ -1285,6 +1285,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX, rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
context, len); context, len);
if (rc == -ERANGE) { if (rc == -ERANGE) {
kfree(context);
/* Need a larger buffer. Query for the right size. */ /* Need a larger buffer. Query for the right size. */
rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX, rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
NULL, 0); NULL, 0);
...@@ -1292,7 +1294,6 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent ...@@ -1292,7 +1294,6 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
dput(dentry); dput(dentry);
goto out_unlock; goto out_unlock;
} }
kfree(context);
len = rc; len = rc;
context = kmalloc(len+1, GFP_NOFS); context = kmalloc(len+1, GFP_NOFS);
if (!context) { if (!context) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment