selinux: fix memory leak in policydb_init() (45385237) · Commits · 戴 / test

Since roles_init() adds some entries to the role hash table, we need to destroy also its keys/values on error, otherwise we get a memory leak in the error path. Cc: <stable@vger.kernel.org> Reported-by:

<syzbot+fee3a14d4cdf92646287@syzkaller.appspotmail.com> Fixes: ("Linux-2.6.12-rc2") Signed-off-by:

Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by:

Paul Moore <paul@paul-moore.com>

security/selinux/ss/policydb.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -274,6 +274,8 @@ static int rangetr_cmp(struct hashtab h, const void k1, const void *k2)
		return v;
		}

		static int (destroy_f[SYM_NUM]) (void key, void datum, void datap);

		/*
		* Initialize a policy database structure.
		*/
		@@ -321,8 +323,10 @@ static int policydb_init(struct policydb *p)
		out:
		hashtab_destroy(p->filename_trans);
		hashtab_destroy(p->range_tr);
		for (i = 0; i < SYM_NUM; i++)
		for (i = 0; i < SYM_NUM; i++) {
		hashtab_map(p->symtab[i].table, destroy_f[i], NULL);
		hashtab_destroy(p->symtab[i].table);
		}
		return rc;
		}

Admin message