Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752985AbcCVU2X (ORCPT ); Tue, 22 Mar 2016 16:28:23 -0400 Received: from h2.hallyn.com ([78.46.35.8]:33046 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751546AbcCVU2T (ORCPT ); Tue, 22 Mar 2016 16:28:19 -0400 Date: Tue, 22 Mar 2016 15:28:17 -0500 From: "Serge E. Hallyn" To: Colin King Cc: Paul Moore , Stephen Smalley , Eric Paris , James Morris , "Serge E . Hallyn" , Nick Kralevich , Jeff Vander Stoep , selinux@tycho.nsa.gov, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] selinux: fix memory leak on node_ptr on error return path Message-ID: <20160322202817.GA9459@mail.hallyn.com> References: <1458601213-5835-1-git-send-email-colin.king@canonical.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1458601213-5835-1-git-send-email-colin.king@canonical.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1102 Lines: 34 Quoting Colin King (colin.king@canonical.com): > From: Colin Ian King > > node_ptr is not being free'd if the list allocation fails, fix > this by kfree'ing it before exiting on the error path. > > Signed-off-by: Colin Ian King Hi, I'm not very familiar with this code any more, but are you sure this is needed and doesn't cause a new bug? It *looks* like the avtab_insert_nonunique() actually inserts the node_ptr into the policydb, and the policydb is the one that should eventually free it. > --- > security/selinux/ss/conditional.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c > index 456e1a9..5d010ef 100644 > --- a/security/selinux/ss/conditional.c > +++ b/security/selinux/ss/conditional.c > @@ -332,6 +332,7 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum > list = kzalloc(sizeof(struct cond_av_list), GFP_KERNEL); > if (!list) { > rc = -ENOMEM; > + kfree(node_ptr); > goto err; > } > > -- > 2.7.3