From 18baef3d95822a6eecc07a8e2fd8929564914a94 Mon Sep 17 00:00:00 2001 From: Xiu Jianfeng Date: Mon, 13 Jun 2022 21:59:53 +0800 Subject: [PATCH] selinux: fix memleak in security_read_state_kernel() BugLink: https://bugs.launchpad.net/bugs/1990162 [ Upstream commit 73de1befcc53a7c68b0c5e76b9b5ac41c517760f ] In this function, it directly returns the result of __security_read_policy without freeing the allocated memory in *data, cause memory leak issue, so free the memory if __security_read_policy failed. Signed-off-by: Xiu Jianfeng [PM: subject line tweak] Signed-off-by: Paul Moore Signed-off-by: Sasha Levin Signed-off-by: Kamal Mostafa Signed-off-by: Stefan Bader --- security/selinux/ss/services.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index db4b4b6acc17..dc738344b46c 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -4045,6 +4045,7 @@ int security_read_policy(struct selinux_state *state, int security_read_state_kernel(struct selinux_state *state, void **data, size_t *len) { + int err; struct selinux_policy *policy; policy = rcu_dereference_protected( @@ -4057,5 +4058,11 @@ int security_read_state_kernel(struct selinux_state *state, if (!*data) return -ENOMEM; - return __security_read_policy(policy, *data, len); + err = __security_read_policy(policy, *data, len); + if (err) { + vfree(*data); + *data = NULL; + *len = 0; + } + return err; } -- 2.39.5