Smack: freeing an error pointer in smk_write_revoke_subj()

PATCH Applied Dan Carpenter 3 participants 3 messages Jun 11, 2015 – Jun 12, 2015

Subsystems (3)

Kernel janitors Security (LSM) Smack security module

lore

Share & tools

lore

Dan Carpenter

author

2015-06-11 08:51 UTC #0 lore raw

PATCH 1/1 Smack: freeing an error pointer in smk_write_revoke_subj()

This code used to rely on the fact that kfree(NULL) was a no-op, but then we changed smk_parse_smack() to return error pointers on failure instead of NULL. Calling kfree() on an error pointer will oops.

I have re-arranged things a bit so that we only free things if they have been allocated.

Fixes e774ad683f42 ('smack: pass error code through pointers')

Signed-off-by Dan Carpenter <[email protected]>

security/smack/smackfs.c +9 -7

index 6beac42..2716d02 100644
@@ -2253,8 +2253,8 @@ static const struct file_operations smk_access2_ops = {
 static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
 				size_t count, loff_t *ppos)
 {
-	char *data = NULL;
-	const char *cp = NULL;
+	char *data;
+	const char *cp;
 	struct smack_known *skp;
 	struct smack_rule *sp;
 	struct list_head *rule_list;

@@ -2276,18 +2276,18 @@ static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
 
 	if (copy_from_user(data, buf, count) != 0) {
 		rc = -EFAULT;
-		goto free_out;
+		goto out_data;
 	}
 
 	cp = smk_parse_smack(data, count);
 	if (IS_ERR(cp)) {
 		rc = PTR_ERR(cp);
-		goto free_out;
+		goto out_data;
 	}
 
 	skp = smk_find_entry(cp);
 	if (skp = NULL)
-		goto free_out;
+		goto out_cp;
 
 	rule_list = &skp->smk_rules;
 	rule_lock = &skp->smk_rules_lock;

@@ -2299,9 +2299,11 @@ static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
 
 	mutex_unlock(rule_lock);
 
-free_out:
-	kfree(data);
+out_cp:
 	kfree(cp);
+out_data:
+	kfree(data);
+
 	return rc;
 }

Lukasz Pawelczyk

2015-06-11 09:11 UTC #1 lore raw

Quoted 9 lines · Dan Carpenter

This code used to rely on the fact that kfree(NULL) was a no-op, but then we changed smk_parse_smack() to return error pointers on failure instead of NULL. Calling kfree() on an error pointer will oops.
I have re-arranged things a bit so that we only free things if they have been allocated.
Fixes e774ad683f42 ('smack: pass error code through pointers')
Signed-off-by Dan Carpenter <[email protected]>

Looks good to me.

Quoted 56 lines

security/smack/smackfs.c +9 -8

index 6beac42..2716d02 100644
@@ -2253,8 +2253,8 @@ static const struct file_operations smk_access2_ops = {
 static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
 				size_t count, loff_t *ppos)
 {
-	char *data = NULL;
-	const char *cp = NULL;
+	char *data;
+	const char *cp;
 	struct smack_known *skp;
 	struct smack_rule *sp;
 	struct list_head *rule_list;

@@ -2276,18 +2276,18 @@ static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
 
 	if (copy_from_user(data, buf, count) != 0) {
 		rc = -EFAULT;
-		goto free_out;
+		goto out_data;
 	}
 
 	cp = smk_parse_smack(data, count);
 	if (IS_ERR(cp)) {
 		rc = PTR_ERR(cp);
-		goto free_out;
+		goto out_data;
 	}
 
 	skp = smk_find_entry(cp);
 	if (skp = NULL)
-		goto free_out;
+		goto out_cp;
 
 	rule_list = &skp->smk_rules;
 	rule_lock = &skp->smk_rules_lock;

@@ -2299,9 +2299,11 @@ static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
 
 	mutex_unlock(rule_lock);
 
-free_out:
-	kfree(data);
+out_cp:
 	kfree(cp);
+out_data:
+	kfree(data);
+
 	return rc;
 }
 
--

To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Signature · 3 lines

Lukasz Pawelczyk
Samsung R&D Institute Poland
Samsung Electronics

Casey Schaufler

maintainer Applied

2015-06-12 20:00 UTC #2 lore raw

In reply to Dan Carpenter

Quoted 9 lines · Dan Carpenter

This code used to rely on the fact that kfree(NULL) was a no-op, but then we changed smk_parse_smack() to return error pointers on failure instead of NULL. Calling kfree() on an error pointer will oops.
I have re-arranged things a bit so that we only free things if they have been allocated.
Fixes e774ad683f42 ('smack: pass error code through pointers')
Signed-off-by Dan Carpenter <[email protected]>

Applied to https://github.com/cschaufler/smack-next.git#smack-for-4.2-stacked

Quoted 57 lines

security/smack/smackfs.c +9 -8

index 6beac42..2716d02 100644
@@ -2253,8 +2253,8 @@ static const struct file_operations smk_access2_ops = {
 static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
 				size_t count, loff_t *ppos)
 {
-	char *data = NULL;
-	const char *cp = NULL;
+	char *data;
+	const char *cp;
 	struct smack_known *skp;
 	struct smack_rule *sp;
 	struct list_head *rule_list;

@@ -2276,18 +2276,18 @@ static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
 
 	if (copy_from_user(data, buf, count) != 0) {
 		rc = -EFAULT;
-		goto free_out;
+		goto out_data;
 	}
 
 	cp = smk_parse_smack(data, count);
 	if (IS_ERR(cp)) {
 		rc = PTR_ERR(cp);
-		goto free_out;
+		goto out_data;
 	}
 
 	skp = smk_find_entry(cp);
 	if (skp = NULL)
-		goto free_out;
+		goto out_cp;
 
 	rule_list = &skp->smk_rules;
 	rule_lock = &skp->smk_rules_lock;

@@ -2299,9 +2299,11 @@ static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
 
 	mutex_unlock(rule_lock);
 
-free_out:
-	kfree(data);
+out_cp:
 	kfree(cp);
+out_data:
+	kfree(data);
+
 	return rc;
 }
 
--

To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html