From: Christian Göttsche <cgzones@googlemail.com>
Date: Thu, 20 Apr 2023 15:04:58 +0000 (+0200)
Subject: selinux: do not leave dangling pointer behind
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=53f3517ae0870fcb398afbba8ff901d0267772b3;p=linux.git

selinux: do not leave dangling pointer behind

In case mls_context_cpy() fails due to OOM set the free'd pointer in
context_cpy() to NULL to avoid it potentially being dereferenced or
free'd again in future.  Freeing a NULL pointer is well-defined and a
hard NULL dereference crash is at least not exploitable and should give
a workable stack trace.

Fixes: 12b29f34558b ("selinux: support deferred mapping of contexts")
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---

diff --git a/security/selinux/ss/context.h b/security/selinux/ss/context.h
index eda32c3d4c0a8..44179977f434c 100644
--- a/security/selinux/ss/context.h
+++ b/security/selinux/ss/context.h
@@ -167,6 +167,7 @@ static inline int context_cpy(struct context *dst, const struct context *src)
 	rc = mls_context_cpy(dst, src);
 	if (rc) {
 		kfree(dst->str);
+		dst->str = NULL;
 		return rc;
 	}
 	return 0;