[RFC] selinux: fix double free in selinux_parse_opts_str()

Commit Message

Paul Moore June 6, 2017, 7:32 p.m. UTC

From: Paul Moore <[e-mail]>

This patch is based on a discussion generated by an earlier patch
from Tetsuo Handa:

* https://marc.info/?t=149035659300001&r=1&w=2

The double free problem involves the mnt_opts field of the
security_mnt_opts struct, selinux_parse_opts_str() frees the memory
on error, but doesn't set the field to NULL so if the caller later
attempts to call security_free_mnt_opts() we trigger the problem.

In order to play it safe we change selinux_parse_opts_str() to call
security_free_mnt_opts() on error instead of free'ing the memory
directly.  This should ensure that everything is handled correctly,
regardless of what the caller may do.

Fixes: e0007529893c1c06 ("LSM/SELinux: Interfaces to allow FS to control mount options")
Cc: [e-mail]
Cc: Tetsuo Handa <[e-mail]>
Reported-by: Dmitry Vyukov <[e-mail]>
Signed-off-by: Paul Moore <[e-mail]>
---
 security/selinux/hooks.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

Comments

Paul Moore June 7, 2017, 8:49 p.m. UTC | #1

On Tue, Jun 6, 2017 at 3:32 PM, Paul Moore <[e-mail]> wrote:
> From: Paul Moore <[e-mail]>
>
> This patch is based on a discussion generated by an earlier patch
> from Tetsuo Handa:
>
> * https://marc.info/?t=149035659300001&r=1&w=2
>
> The double free problem involves the mnt_opts field of the
> security_mnt_opts struct, selinux_parse_opts_str() frees the memory
> on error, but doesn't set the field to NULL so if the caller later
> attempts to call security_free_mnt_opts() we trigger the problem.
>
> In order to play it safe we change selinux_parse_opts_str() to call
> security_free_mnt_opts() on error instead of free'ing the memory
> directly.  This should ensure that everything is handled correctly,
> regardless of what the caller may do.
>
> Fixes: e0007529893c1c06 ("LSM/SELinux: Interfaces to allow FS to control mount options")
> Cc: [e-mail]
> Cc: Tetsuo Handa <[e-mail]>
> Reported-by: Dmitry Vyukov <[e-mail]>
> Signed-off-by: Paul Moore <[e-mail]>
> ---
>  security/selinux/hooks.c |    5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)

FYI, I just merged this into selinux/stable-4.12.

Patch

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 9926adbd50a9..05c0df050a39 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1102,10 +1102,8 @@  static int selinux_parse_opts_str(char *options,
 
 	opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
 				       GFP_KERNEL);
-	if (!opts->mnt_opts_flags) {
-		kfree(opts->mnt_opts);
+	if (!opts->mnt_opts_flags)
 		goto out_err;
-	}
 
 	if (fscontext) {
 		opts->mnt_opts[num_mnt_opts] = fscontext;
@@ -1128,6 +1126,7 @@  static int selinux_parse_opts_str(char *options,
 	return 0;
 
 out_err:
+	security_free_mnt_opts(opts);
 	kfree(context);
 	kfree(defcontext);
 	kfree(fscontext);