Re: [PATCH] hooks: fix a missing-check bug in selinux_add_mnt_opt()
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: 2019-05-30 08:30:27
Also in:
lkml, selinux
On Thu, May 30, 2019 at 10:06 AM Gen Zhang [off-list ref] wrote:
In selinux_add_mnt_opt(), 'val' is allcoted by kmemdup_nul(). It returns NULL when fails. So 'val' should be checked. Signed-off-by: Gen Zhang <redacted>
Please add a Fixes tag here, too:
Fixes: 757cbe597fe8 ("LSM: new method: ->sb_add_mnt_opt()")
quoted hunk ↗ jump to hunk
---diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 3ec702c..4797c63 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c@@ -1052,8 +1052,11 @@ static int selinux_add_mnt_opt(const char *option, const char *val, int len, if (token == Opt_error) return -EINVAL; - if (token != Opt_seclabel) - val = kmemdup_nul(val, len, GFP_KERNEL); + if (token != Opt_seclabel) { + val = kmemdup_nul(val, len, GFP_KERNEL); + if (!val) + return -ENOMEM;
There is one extra tab character in the above three lines ^^^
+ }
rc = selinux_add_opt(token, val, mnt_opts);
if (unlikely(rc)) {
kfree(val);Thanks, -- Ondrej Mosnacek <omosnace at redhat dot com> Software Engineer, Security Technologies Red Hat, Inc.