Commit e8393179 authored Sep 02, 2020 by Tycho Andersen Committed by Kees Cook Sep 08, 2020

seccomp: don't leave dangling ->notif if file allocation fails



Christian and Kees both pointed out that this is a bit sloppy to open-code
both places, and Christian points out that we leave a dangling pointer to
->notif if file allocation fails. Since we check ->notif for null in order
to determine if it's ok to install a filter, this means people won't be
able to install a filter if the file allocation fails for some reason, even
if they subsequently should be able to.

To fix this, let's hoist this free+null into its own little helper and use
it.

Reported-by: Kees Cook <keescook@chromium.org>
Reported-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Tycho Andersen <tycho@tycho.pizza>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Link: https://lore.kernel.org/r/20200902140953.1201956-1-tycho@tycho.pizza


Signed-off-by: Kees Cook <keescook@chromium.org>

parent 19d1d49f

kernel/seccomp.c

+8 −3

Original line number	Diff line number	Diff line
		@@ -1109,6 +1109,12 @@ out:
		}

		#ifdef CONFIG_SECCOMP_FILTER
		static void seccomp_notify_free(struct seccomp_filter *filter)
		{
		kfree(filter->notif);
		filter->notif = NULL;
		}

		static void seccomp_notify_detach(struct seccomp_filter *filter)
		{
		struct seccomp_knotif *knotif;
		@@ -1138,8 +1144,7 @@ static void seccomp_notify_detach(struct seccomp_filter *filter)
		complete(&knotif->ready);
		}

		kfree(filter->notif);
		filter->notif = NULL;
		seccomp_notify_free(filter);
		mutex_unlock(&filter->notify_lock);
		}

		@@ -1494,7 +1499,7 @@ static struct file init_listener(struct seccomp_filter filter)

		out_notif:
		if (IS_ERR(ret))
		kfree(filter->notif);
		seccomp_notify_free(filter);
		out:
		return ret;
		}

Admin message