Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1752368AbcCVViV (ORCPT <rfc822;w@1wt.eu>);
	Tue, 22 Mar 2016 17:38:21 -0400
Received: from youngberry.canonical.com ([91.189.89.112]:36209 "EHLO
	youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1751325AbcCVViT (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Tue, 22 Mar 2016 17:38:19 -0400
Subject: Re: [PATCH] selinux: fix memory leak on node_ptr on error return path
To: Paul Moore <paul@paul-moore.com>, "Serge E. Hallyn" <serge@hallyn.com>
References: <1458601213-5835-1-git-send-email-colin.king@canonical.com>
 <20160322202817.GA9459@mail.hallyn.com>
 <CAHC9VhThVmP14F_Eu3C=bBWPGkufFO5v9J0UFyeLFPLNW1FA7Q@mail.gmail.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>, Eric Paris <eparis@parisplace.org>,
        James Morris <james.l.morris@oracle.com>,
        Nick Kralevich <nnk@google.com>, Jeff Vander Stoep <jeffv@google.com>,
        selinux@tycho.nsa.gov, linux-security-module@vger.kernel.org,
        linux-kernel@vger.kernel.org
From: Colin Ian King <colin.king@canonical.com>
Message-ID: <56F1BB47.9070101@canonical.com>
Date: Tue, 22 Mar 2016 21:38:15 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.6.0
MIME-Version: 1.0
In-Reply-To: <CAHC9VhThVmP14F_Eu3C=bBWPGkufFO5v9J0UFyeLFPLNW1FA7Q@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 955
Lines: 24

On 22/03/16 21:35, Paul Moore wrote:
> On Tue, Mar 22, 2016 at 4:28 PM, Serge E. Hallyn <serge@hallyn.com> wrote:
>> Quoting Colin King (colin.king@canonical.com):
>>> From: Colin Ian King <colin.king@canonical.com>
>>>
>>> node_ptr is not being free'd if the list allocation fails, fix
>>> this by kfree'ing it before exiting on the error path.
>>>
>>> Signed-off-by: Colin Ian King <colin.king@canonical.com>
>>
>> Hi,
>>
>> I'm not very familiar with this code any more, but are you sure
>> this is needed and doesn't cause a new bug?  It *looks* like
>> the avtab_insert_nonunique() actually inserts the node_ptr
>> into the policydb, and the policydb is the one that should
>> eventually free it.
> 
> Exactly.  cond_insertf() calls avtab_insert_nonunique() which calls
> avtab_insert_node() which adds the node to the avtab.  The avtab will
> get cleaned up later by the error handling code in the cond_insertf()
> call chain.
> 
My bad, apologies.