path: root/security/selinux/ss
diff options
authorTom Rix <>2020-06-15 13:45:48 -0700
committerPaul Moore <>2020-06-16 20:25:19 -0400
commitaa449a7965a6172a89d48844c313708962216f1f (patch)
treec76ab322333c9ec3f3087e75dd95cbaa5decafe9 /security/selinux/ss
parent65de50969a77509452ae590e9449b70a22b923bb (diff)
selinux: fix a double free in cond_read_node()/cond_read_list()
Clang static analysis reports this double free error security/selinux/ss/conditional.c:139:2: warning: Attempt to free released memory [unix.Malloc] kfree(node->expr.nodes); ^~~~~~~~~~~~~~~~~~~~~~~ When cond_read_node fails, it calls cond_node_destroy which frees the node but does not poison the entry in the node list. So when it returns to its caller cond_read_list, cond_read_list deletes the partial list. The latest entry in the list will be deleted twice. So instead of freeing the node in cond_read_node, let list freeing in code_read_list handle the freeing the problem node along with all of the earlier nodes. Because cond_read_node no longer does any error handling, the goto's the error case are redundant. Instead just return the error code. Cc: Fixes: 60abd3181db2 ("selinux: convert cond_list to array") Signed-off-by: Tom Rix <> Reviewed-by: Ondrej Mosnacek <> [PM: subject line tweaks] Signed-off-by: Paul Moore <>
Diffstat (limited to 'security/selinux/ss')
1 files changed, 5 insertions, 13 deletions
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index 939a74fd8fb4..4867dfc5337a 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -392,27 +392,19 @@ static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp)
rc = next_entry(buf, fp, sizeof(u32) * 2);
if (rc)
- goto err;
+ return rc;
expr->expr_type = le32_to_cpu(buf[0]);
expr->bool = le32_to_cpu(buf[1]);
- if (!expr_node_isvalid(p, expr)) {
- rc = -EINVAL;
- goto err;
- }
+ if (!expr_node_isvalid(p, expr))
+ return -EINVAL;
rc = cond_read_av_list(p, fp, &node->true_list, NULL);
if (rc)
- goto err;
- rc = cond_read_av_list(p, fp, &node->false_list, &node->true_list);
- if (rc)
- goto err;
- return 0;
- cond_node_destroy(node);
- return rc;
+ return rc;
+ return cond_read_av_list(p, fp, &node->false_list, &node->true_list);
int cond_read_list(struct policydb *p, void *fp)