selinux: fix NULL dereference in policydb_destroy()
mainline inclusion from master commit 6a1afffb category: bugfix bugzilla: 120851 CVE: NA --------------------------- The conversion to kvmalloc() forgot to account for the possibility that p->type_attr_map_array might be null in policydb_destroy(). Fix this by destroying its contents only if it is not NULL. Also make sure ebitmap_init() is called on all entries before policydb_destroy() can be called. Right now this is a no-op, because both kvcalloc() and ebitmap_init() just zero out the whole struct, but let's rather not rely on a specific implementation. Reported-by:<syzbot+a57b2aff60832666fc28@syzkaller.appspotmail.com> Fixes: acdf52d9 ("selinux: convert to kvmalloc") Signed-off-by:
Ondrej Mosnacek <omosnace@redhat.com> Acked-by:
Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by:
Paul Moore <paul@paul-moore.com> Signed-off-by:
Wang Weiyang <wangweiyang2@huawei.com> Conflicts: security/selinux/ss/policydb.c [ acdf52d9 is not applied so only half of this commit is used ] Reviewed-by:
Xiu Jianfeng <xiujianfeng@huawei.com> Signed-off-by:
Yang Yingliang <yangyingliang@huawei.com>
Loading
Please sign in to comment