Skip to content

Commit a20db10

Browse files
eparisaldrinholmes
authored andcommitted
SELinux: possible NULL deref in context_struct_to_string
It's possible that the caller passed a NULL for scontext. However if this is a defered mapping we might still attempt to call *scontext=kstrdup(). This is bad. Instead just return the len. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
1 parent d52319d commit a20db10

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

security/selinux/ss/services.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1018,9 +1018,11 @@ static int context_struct_to_string(struct context *context, char **scontext, u3
10181018

10191019
if (context->len) {
10201020
*scontext_len = context->len;
1021-
*scontext = kstrdup(context->str, GFP_ATOMIC);
1022-
if (!(*scontext))
1023-
return -ENOMEM;
1021+
if (scontext) {
1022+
*scontext = kstrdup(context->str, GFP_ATOMIC);
1023+
if (!(*scontext))
1024+
return -ENOMEM;
1025+
}
10241026
return 0;
10251027
}
10261028

0 commit comments

Comments
 (0)