From ea9a004020c96178f1307019c689d5f588414850 Mon Sep 17 00:00:00 2001 From: Gen Zhang Date: Wed, 12 Jun 2019 21:28:21 +0800 Subject: [PATCH] selinux: fix a missing-check bug in selinux_add_mnt_opt( ) commit e2e0e09758a6f7597de0f9b819647addfb71b6bd upstream. In selinux_add_mnt_opt(), 'val' is allocated by kmemdup_nul(). It returns NULL when fails. So 'val' should be checked. And 'mnt_opts' should be freed when error. Signed-off-by: Gen Zhang Fixes: 757cbe597fe8 ("LSM: new method: ->sb_add_mnt_opt()") Cc: [PM: fixed some indenting problems] Signed-off-by: Paul Moore Signed-off-by: Greg Kroah-Hartman --- security/selinux/hooks.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 28bff30c2f150..d5feb2a0125d0 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1048,15 +1048,24 @@ static int selinux_add_mnt_opt(const char *option, const char *val, int len, if (token == Opt_error) return -EINVAL; - if (token != Opt_seclabel) + if (token != Opt_seclabel) { val = kmemdup_nul(val, len, GFP_KERNEL); + if (!val) { + rc = -ENOMEM; + goto free_opt; + } + } rc = selinux_add_opt(token, val, mnt_opts); if (unlikely(rc)) { kfree(val); - if (*mnt_opts) { - selinux_free_mnt_opts(*mnt_opts); - *mnt_opts = NULL; - } + goto free_opt; + } + return rc; + +free_opt: + if (*mnt_opts) { + selinux_free_mnt_opts(*mnt_opts); + *mnt_opts = NULL; } return rc; } -- 2.39.2