Commit 551007a8 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'selinux-pr-20220203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux 

Pull selinux fix from Paul Moore:
 "One small SELinux patch to ensure that a policy structure field is
  properly reset after freeing so that we don't inadvertently do a
  double-free on certain error conditions"

* tag 'selinux-pr-20220203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: fix double free of cond_list on error paths
parents 25b20ae8 186edf7e

security/selinux/ss/conditional.c

+2 −1
Original line number Diff line number Diff line
@@ -152,6 +152,8 @@ static void cond_list_destroy(struct policydb *p) 
	for (i = 0; i < p->cond_list_len; i++)

		cond_node_destroy(&p->cond_list[i]);

	kfree(p->cond_list);

	p->cond_list = NULL;

	p->cond_list_len = 0;

}



void cond_policydb_destroy(struct policydb *p)
@@ -441,7 +443,6 @@ int cond_read_list(struct policydb *p, void *fp) 
	return 0;

err:

	cond_list_destroy(p);

	p->cond_list = NULL;

	return rc;

}