[GIT PULL] selinux: fix double free bug

[James Morris]

Please pull this fix for a double free bug in SELinux.

The following changes since commit 63f700aab4c11d46626de3cd051dae56cf7e9056:

  Merge tag 'xtensa-20170612' of git://github.com/jcmvbkbc/linux-xtensa (2017-06-13 15:09:10 +0900)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git for-linus

Paul Moore (1):
      selinux: fix double free in selinux_parse_opts_str()

 security/selinux/hooks.c |    5 ++---
 1 files changed, 2 insertions(+), 3 deletions(-)

---

commit 023f108dcc187e34ef864bf10ed966cf25e14e2a
Author: Paul Moore <paul at paul-moore.com>
Date:   Wed Jun 7 16:48:19 2017 -0400

    selinux: fix double free in selinux_parse_opts_str()
    
    This patch is based on a discussion generated by an earlier patch
    from Tetsuo Handa:
    
    * https://marc.info/?t=149035659300001&r=1&w=2
    
    The double free problem involves the mnt_opts field of the
    security_mnt_opts struct, selinux_parse_opts_str() frees the memory
    on error, but doesn't set the field to NULL so if the caller later
    attempts to call security_free_mnt_opts() we trigger the problem.
    
    In order to play it safe we change selinux_parse_opts_str() to call
    security_free_mnt_opts() on error instead of free'ing the memory
    directly.  This should ensure that everything is handled correctly,
    regardless of what the caller may do.
    
    Fixes: e0007529893c1c06 ("LSM/SELinux: Interfaces to allow FS to control mount options")
    Cc: stable at vger.kernel.org
    Cc: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
    Reported-by: Dmitry Vyukov <dvyukov at google.com>
    Signed-off-by: Paul Moore <paul at paul-moore.com>
    Signed-off-by: James Morris <james.l.morris at oracle.com>

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e67a526..819fd68 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1106,10 +1106,8 @@ static int selinux_parse_opts_str(char *options,
 
 	opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
 				       GFP_KERNEL);
-	if (!opts->mnt_opts_flags) {
-		kfree(opts->mnt_opts);
+	if (!opts->mnt_opts_flags)
 		goto out_err;
-	}
 
 	if (fscontext) {
 		opts->mnt_opts[num_mnt_opts] = fscontext;
@@ -1132,6 +1130,7 @@ static int selinux_parse_opts_str(char *options,
 	return 0;
 
 out_err:
+	security_free_mnt_opts(opts);
 	kfree(context);
 	kfree(defcontext);
 	kfree(fscontext);


--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html