korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-04 09:34:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

Smack: freeing an error pointer in smk_write_revoke_subj()

Browse Source 
This code used to rely on the fact that kfree(NULL) was a no-op, but
then we changed smk_parse_smack() to return error pointers on failure
instead of NULL.  Calling kfree() on an error pointer will oops.

I have re-arranged things a bit so that we only free things if they
have been allocated.

Fixes: e774ad683f ('smack: pass error code through pointers')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
This commit is contained in:
Dan Carpenter 2015-06-11 11:51:16 +03:00 committed by Casey Schaufler
parent c0d77c8844
commit 5430209497
1 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
security/smack/smackfs.c
View File

@ -2253,8 +2253,8 @@ static const struct file_operations smk_access2_ops = {
static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf, static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
char *data = NULL; char *data;
const char *cp = NULL; const char *cp;
struct smack_known *skp; struct smack_known *skp;
struct smack_rule *sp; struct smack_rule *sp;
struct list_head *rule_list; struct list_head *rule_list;
@ -2276,18 +2276,18 @@ static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
if (copy_from_user(data, buf, count) != 0) { if (copy_from_user(data, buf, count) != 0) {
rc = -EFAULT; rc = -EFAULT;
goto free_out; goto out_data;
} }
cp = smk_parse_smack(data, count); cp = smk_parse_smack(data, count);
if (IS_ERR(cp)) { if (IS_ERR(cp)) {
rc = PTR_ERR(cp); rc = PTR_ERR(cp);
goto free_out; goto out_data;
} }
skp = smk_find_entry(cp); skp = smk_find_entry(cp);
if (skp == NULL) if (skp == NULL)
goto free_out; goto out_cp;
rule_list = &skp->smk_rules; rule_list = &skp->smk_rules;
rule_lock = &skp->smk_rules_lock; rule_lock = &skp->smk_rules_lock;
@ -2299,9 +2299,11 @@ static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
mutex_unlock(rule_lock); mutex_unlock(rule_lock);
free_out: out_cp:
kfree(data);
kfree(cp); kfree(cp);
out_data:
kfree(data);
return rc; return rc;
} }