| Message ID | 20220613135953.135998-1-xiujianfeng@huawei.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | [-next] selinux: Fix memleak in security_read_state_kernel | expand |
On Mon, Jun 13, 2022 at 10:01 AM Xiu Jianfeng <xiujianfeng@huawei.com> wrote: > > In this function, it directly returns the result of __security_read_policy > without freeing the allocated memory in *data, cause memory leak issue, > so free the memory if __security_read_policy failed. > > Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> > --- > security/selinux/ss/services.c | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) Merged into selinux/next, thanks.
On Mon, Jun 13, 2022 at 4:02 PM Xiu Jianfeng <xiujianfeng@huawei.com> wrote: > In this function, it directly returns the result of __security_read_policy > without freeing the allocated memory in *data, cause memory leak issue, > so free the memory if __security_read_policy failed. > > Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> > --- > security/selinux/ss/services.c | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > > diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c > index 69b2734311a6..fe5fcf571c56 100644 > --- a/security/selinux/ss/services.c > +++ b/security/selinux/ss/services.c > @@ -4048,6 +4048,7 @@ int security_read_policy(struct selinux_state *state, > int security_read_state_kernel(struct selinux_state *state, > void **data, size_t *len) > { > + int err; > struct selinux_policy *policy; > > policy = rcu_dereference_protected( > @@ -4060,5 +4061,11 @@ int security_read_state_kernel(struct selinux_state *state, > if (!*data) > return -ENOMEM; > > - return __security_read_policy(policy, *data, len); > + err = __security_read_policy(policy, *data, len); > + if (err) { > + vfree(*data); > + *data = NULL; > + *len = 0; > + } > + return err; > } > -- > 2.17.1 > security_read_policy() defined a few lines above has the same pattern (just with vmalloc_user() in place of vmalloc()). Would you like to send another patch to fix that function as well?
在 2022/6/14 20:57, Ondrej Mosnacek 写道: > On Mon, Jun 13, 2022 at 4:02 PM Xiu Jianfeng <xiujianfeng@huawei.com> wrote: >> In this function, it directly returns the result of __security_read_policy >> without freeing the allocated memory in *data, cause memory leak issue, >> so free the memory if __security_read_policy failed. >> >> Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> >> --- >> security/selinux/ss/services.c | 9 ++++++++- >> 1 file changed, 8 insertions(+), 1 deletion(-) >> >> diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c >> index 69b2734311a6..fe5fcf571c56 100644 >> --- a/security/selinux/ss/services.c >> +++ b/security/selinux/ss/services.c >> @@ -4048,6 +4048,7 @@ int security_read_policy(struct selinux_state *state, >> int security_read_state_kernel(struct selinux_state *state, >> void **data, size_t *len) >> { >> + int err; >> struct selinux_policy *policy; >> >> policy = rcu_dereference_protected( >> @@ -4060,5 +4061,11 @@ int security_read_state_kernel(struct selinux_state *state, >> if (!*data) >> return -ENOMEM; >> >> - return __security_read_policy(policy, *data, len); >> + err = __security_read_policy(policy, *data, len); >> + if (err) { >> + vfree(*data); >> + *data = NULL; >> + *len = 0; >> + } >> + return err; >> } >> -- >> 2.17.1 >> > security_read_policy() defined a few lines above has the same pattern > (just with vmalloc_user() in place of vmalloc()). Would you like to > send another patch to fix that function as well? No problem, patch already sent. >
On Tue, Jun 14, 2022 at 3:35 PM xiujianfeng <xiujianfeng@huawei.com> wrote: > > > 在 2022/6/14 20:57, Ondrej Mosnacek 写道: > > On Mon, Jun 13, 2022 at 4:02 PM Xiu Jianfeng <xiujianfeng@huawei.com> wrote: > >> In this function, it directly returns the result of __security_read_policy > >> without freeing the allocated memory in *data, cause memory leak issue, > >> so free the memory if __security_read_policy failed. > >> > >> Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> > >> --- > >> security/selinux/ss/services.c | 9 ++++++++- > >> 1 file changed, 8 insertions(+), 1 deletion(-) > >> > >> diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c > >> index 69b2734311a6..fe5fcf571c56 100644 > >> --- a/security/selinux/ss/services.c > >> +++ b/security/selinux/ss/services.c > >> @@ -4048,6 +4048,7 @@ int security_read_policy(struct selinux_state *state, > >> int security_read_state_kernel(struct selinux_state *state, > >> void **data, size_t *len) > >> { > >> + int err; > >> struct selinux_policy *policy; > >> > >> policy = rcu_dereference_protected( > >> @@ -4060,5 +4061,11 @@ int security_read_state_kernel(struct selinux_state *state, > >> if (!*data) > >> return -ENOMEM; > >> > >> - return __security_read_policy(policy, *data, len); > >> + err = __security_read_policy(policy, *data, len); > >> + if (err) { > >> + vfree(*data); > >> + *data = NULL; > >> + *len = 0; > >> + } > >> + return err; > >> } > >> -- > >> 2.17.1 > >> > > security_read_policy() defined a few lines above has the same pattern > > (just with vmalloc_user() in place of vmalloc()). Would you like to > > send another patch to fix that function as well? > No problem, patch already sent. Wow, you're fast :) Thanks!
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 69b2734311a6..fe5fcf571c56 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -4048,6 +4048,7 @@ int security_read_policy(struct selinux_state *state, int security_read_state_kernel(struct selinux_state *state, void **data, size_t *len) { + int err; struct selinux_policy *policy; policy = rcu_dereference_protected( @@ -4060,5 +4061,11 @@ int security_read_state_kernel(struct selinux_state *state, if (!*data) return -ENOMEM; - return __security_read_policy(policy, *data, len); + err = __security_read_policy(policy, *data, len); + if (err) { + vfree(*data); + *data = NULL; + *len = 0; + } + return err; }
In this function, it directly returns the result of __security_read_policy without freeing the allocated memory in *data, cause memory leak issue, so free the memory if __security_read_policy failed. Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> --- security/selinux/ss/services.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)