summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2022-02-04 03:44:12 +0300
committerLinus Torvalds <torvalds@linux-foundation.org>2022-02-04 03:44:12 +0300
commit551007a8f10afdc45959ad637d6bee816716769f (patch)
treee2042bb808e98fcdd637c92e16523ef35cc80039 /security
parent25b20ae8151b3d5289896f4f200ff790d2cdf4bf (diff)
parent186edf7e368c40d06cf727a1ad14698ea67b74ad (diff)
downloadlinux-551007a8f10afdc45959ad637d6bee816716769f.tar.xz
Merge tag 'selinux-pr-20220203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux
Pull selinux fix from Paul Moore: "One small SELinux patch to ensure that a policy structure field is properly reset after freeing so that we don't inadvertently do a double-free on certain error conditions" * tag 'selinux-pr-20220203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: fix double free of cond_list on error paths
Diffstat (limited to 'security')
-rw-r--r--security/selinux/ss/conditional.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index 2ec6e5cd25d9..feb206f3acb4 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -152,6 +152,8 @@ static void cond_list_destroy(struct policydb *p)
for (i = 0; i < p->cond_list_len; i++)
cond_node_destroy(&p->cond_list[i]);
kfree(p->cond_list);
+ p->cond_list = NULL;
+ p->cond_list_len = 0;
}
void cond_policydb_destroy(struct policydb *p)
@@ -441,7 +443,6 @@ int cond_read_list(struct policydb *p, void *fp)
return 0;
err:
cond_list_destroy(p);
- p->cond_list = NULL;
return rc;
}