summaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorGaosheng Cui <cuigaosheng1@huawei.com>2022-10-25 21:33:57 +0800
committerPaul Moore <paul@paul-moore.com>2022-10-28 06:44:33 -0400
commit8cf0a1bc12870d148ae830a4ba88cfdf0e879cee (patch)
treec5937416b5bb6b933ef771b53105d3806ba02969 /security
parent9abf2313adc1ca1b6180c508c25f22f9395cc780 (diff)
downloadlinux-stable-8cf0a1bc12870d148ae830a4ba88cfdf0e879cee.tar.gz
linux-stable-8cf0a1bc12870d148ae830a4ba88cfdf0e879cee.tar.bz2
linux-stable-8cf0a1bc12870d148ae830a4ba88cfdf0e879cee.zip
capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
In cap_inode_getsecurity(), we will use vfs_getxattr_alloc() to complete the memory allocation of tmpbuf, if we have completed the memory allocation of tmpbuf, but failed to call handler->get(...), there will be a memleak in below logic: |-- ret = (int)vfs_getxattr_alloc(mnt_userns, ...) | /* ^^^ alloc for tmpbuf */ |-- value = krealloc(*xattr_value, error + 1, flags) | /* ^^^ alloc memory */ |-- error = handler->get(handler, ...) | /* error! */ |-- *xattr_value = value | /* xattr_value is &tmpbuf (memory leak!) */ So we will try to free(tmpbuf) after vfs_getxattr_alloc() fails to fix it. Cc: stable@vger.kernel.org Fixes: 8db6c34f1dbc ("Introduce v3 namespaced file capabilities") Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> Acked-by: Serge Hallyn <serge@hallyn.com> [PM: subject line and backtrace tweaks] Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security')
-rw-r--r--security/commoncap.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/security/commoncap.c b/security/commoncap.c
index 5fc8986c3c77..bc751fa5adad 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -401,8 +401,10 @@ int cap_inode_getsecurity(struct user_namespace *mnt_userns,
&tmpbuf, size, GFP_NOFS);
dput(dentry);
- if (ret < 0 || !tmpbuf)
- return ret;
+ if (ret < 0 || !tmpbuf) {
+ size = ret;
+ goto out_free;
+ }
fs_ns = inode->i_sb->s_user_ns;
cap = (struct vfs_cap_data *) tmpbuf;