netlabel: Fix memory leak in netlbl_mgmt_add_common

[ Upstream commit b8f6b0522c298ae9267bd6584e19b942a0636910 ]

Hulk Robot reported memory leak in netlbl_mgmt_add_common.
The problem is non-freed map in case of netlbl_domhsh_add() failed.

BUG: memory leak
unreferenced object 0xffff888100ab7080 (size 96):
  comm "syz-executor537", pid 360, jiffies 4294862456 (age 22.678s)
  hex dump (first 32 bytes):
    05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01  ................
  backtrace:
    [<0000000008b40026>] netlbl_mgmt_add_common.isra.0+0xb2a/0x1b40
    [<000000003be10950>] netlbl_mgmt_add+0x271/0x3c0
    [<00000000c70487ed>] genl_family_rcv_msg_doit.isra.0+0x20e/0x320
    [<000000001f2ff614>] genl_rcv_msg+0x2bf/0x4f0
    [<0000000089045792>] netlink_rcv_skb+0x134/0x3d0
    [<0000000020e96fdd>] genl_rcv+0x24/0x40
    [<0000000042810c66>] netlink_unicast+0x4a0/0x6a0
    [<000000002e1659f0>] netlink_sendmsg+0x789/0xc70
    [<000000006e43415f>] sock_sendmsg+0x139/0x170
    [<00000000680a73d7>] ____sys_sendmsg+0x658/0x7d0
    [<0000000065cbb8af>] ___sys_sendmsg+0xf8/0x170
    [<0000000019932b6c>] __sys_sendmsg+0xd3/0x190
    [<00000000643ac172>] do_syscall_64+0x37/0x90
    [<000000009b79d6dc>] entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: 63c416887437 ("netlabel: Add network address selectors to the NetLabel/LSM domain mapping")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Liu Shixin <liushixin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index 13f777f20995bbe02edbce36a9c04f2518fe0355..5f1218dc9162aefb40b2aabf2a8efa17cf543337 100644 (file)
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -92,6 +92,7 @@ static const struct nla_policy netlbl_mgmt_genl_policy[NLBL_MGMT_A_MAX + 1] = {
 static int netlbl_mgmt_add_common(struct genl_info *info,
                                  struct netlbl_audit *audit_info)
 {
+       void *pmap = NULL;
        int ret_val = -EINVAL;
        struct netlbl_domaddr_map *addrmap = NULL;
        struct cipso_v4_doi *cipsov4 = NULL;
@@ -165,6 +166,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                        ret_val = -ENOMEM;
                        goto add_free_addrmap;
                }
+               pmap = map;
                map->list.addr = addr->s_addr & mask->s_addr;
                map->list.mask = mask->s_addr;
                map->list.valid = 1;
@@ -173,10 +175,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                        map->def.cipso = cipsov4;
 
                ret_val = netlbl_af4list_add(&map->list, &addrmap->list4);
-               if (ret_val != 0) {
-                       kfree(map);
-                       goto add_free_addrmap;
-               }
+               if (ret_val != 0)
+                       goto add_free_map;
 
                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
                entry->def.addrsel = addrmap;
@@ -212,6 +212,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                        ret_val = -ENOMEM;
                        goto add_free_addrmap;
                }
+               pmap = map;
                map->list.addr = *addr;
                map->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
                map->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
@@ -222,10 +223,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                map->def.type = entry->def.type;
 
                ret_val = netlbl_af6list_add(&map->list, &addrmap->list6);
-               if (ret_val != 0) {
-                       kfree(map);
-                       goto add_free_addrmap;
-               }
+               if (ret_val != 0)
+                       goto add_free_map;
 
                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
                entry->def.addrsel = addrmap;
@@ -234,10 +233,12 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
 
        ret_val = netlbl_domhsh_add(entry, audit_info);
        if (ret_val != 0)
-               goto add_free_addrmap;
+               goto add_free_map;
 
        return 0;
 
+add_free_map:
+       kfree(pmap);
 add_free_addrmap:
        kfree(addrmap);
 add_doi_put_def: