Commit e8ae646a authored by Christian Göttsche's avatar Christian Göttsche Committed by sanglipeng
Browse files

selinux: set next pointer before attaching to list 

stable inclusion
from stable-v5.10.193
commit 0dbedf9afee329a548e78775bf921e6e0a0d3594
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9399M

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0dbedf9afee329a548e78775bf921e6e0a0d3594



--------------------------------

commit 70d91dc9 upstream.

Set the next pointer in filename_trans_read_helper() before attaching
the new node under construction to the list, otherwise garbage would be
dereferenced on subsequent failure during cleanup in the out goto label.

Cc: <stable@vger.kernel.org>
Fixes: 43005902 ("selinux: implement new format of filename transitions")
Signed-off-by: default avatarChristian Göttsche <cgzones@googlemail.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
parent 4c107af2

security/selinux/ss/policydb.c

+1 −1
Original line number Diff line number Diff line
@@ -2011,6 +2011,7 @@ static int filename_trans_read_helper(struct policydb *p, void *fp) 
		if (!datum)

			goto out;



		datum->next = NULL;

		*dst = datum;



		/* ebitmap_read() will at least init the bitmap */
@@ -2023,7 +2024,6 @@ static int filename_trans_read_helper(struct policydb *p, void *fp) 
			goto out;



		datum->otype = le32_to_cpu(buf[0]);

		datum->next = NULL;



		dst = &datum->next;

	}