提交 6e8c751e 编写于 作者: C Chad Sellers 提交者: David S. Miller

SELinux: Bug fix in polidydb_destroy

This patch fixes two bugs in policydb_destroy. Two list pointers
(policydb.ocontexts[i] and policydb.genfs) were not being reset to NULL when
the lists they pointed to were being freed. This caused a problem when the
initial policy load failed, as the policydb being destroyed was not a
temporary new policydb that was thrown away, but rather was the global
(active) policydb. Consequently, later functions, particularly
sys_bind->selinux_socket_bind->security_node_sid and
do_rw_proc->selinux_sysctl->selinux_proc_get_sid->security_genfs_sid tried
to dereference memory that had previously been freed.
Signed-off-by: NChad Sellers <csellers@tresys.com>
Signed-off-by: NJames Morris <jmorris@namei.org>
上级 3bccfbc7
...@@ -618,6 +618,7 @@ void policydb_destroy(struct policydb *p) ...@@ -618,6 +618,7 @@ void policydb_destroy(struct policydb *p)
c = c->next; c = c->next;
ocontext_destroy(ctmp,i); ocontext_destroy(ctmp,i);
} }
p->ocontexts[i] = NULL;
} }
g = p->genfs; g = p->genfs;
...@@ -633,6 +634,7 @@ void policydb_destroy(struct policydb *p) ...@@ -633,6 +634,7 @@ void policydb_destroy(struct policydb *p)
g = g->next; g = g->next;
kfree(gtmp); kfree(gtmp);
} }
p->genfs = NULL;
cond_policydb_destroy(p); cond_policydb_destroy(p);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册