summaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>2018-04-10 15:15:16 +0900
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-04-29 11:33:16 +0200
commit77df079be9b480fbac36d407e76df4c29d719407 (patch)
tree937a21ac4c2895d7c8397b5e789f10f954f99947 /security
parent540e7b5be492df4aab0ebbd13f658cc096149575 (diff)
downloadlinux-stable-77df079be9b480fbac36d407e76df4c29d719407.tar.gz
linux-stable-77df079be9b480fbac36d407e76df4c29d719407.tar.bz2
linux-stable-77df079be9b480fbac36d407e76df4c29d719407.zip
commoncap: Handle memory allocation failure.
commit 1f5781725dcbb026438e77091c91a94f678c3522 upstream. syzbot is reporting NULL pointer dereference at xattr_getsecurity() [1], for cap_inode_getsecurity() is returning sizeof(struct vfs_cap_data) when memory allocation failed. Return -ENOMEM if memory allocation failed. [1] https://syzkaller.appspot.com/bug?id=a55ba438506fe68649a5f50d2d82d56b365e0107 Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Fixes: 8db6c34f1dbc8e06 ("Introduce v3 namespaced file capabilities") Reported-by: syzbot <syzbot+9369930ca44f29e60e2d@syzkaller.appspotmail.com> Cc: stable <stable@vger.kernel.org> # 4.14+ Acked-by: Serge E. Hallyn <serge@hallyn.com> Acked-by: James Morris <james.morris@microsoft.com> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'security')
-rw-r--r--security/commoncap.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/security/commoncap.c b/security/commoncap.c
index 7b01431d1e19..1c1f64582bb5 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -449,6 +449,8 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
magic |= VFS_CAP_FLAGS_EFFECTIVE;
memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
cap->magic_etc = cpu_to_le32(magic);
+ } else {
+ size = -ENOMEM;
}
}
kfree(tmpbuf);