[PATCH 1/4] Bug fix in polidydb_destroy

[Chad Sellers <csellers@tresys.com>]

This patch fixes two bugs in policydb_destroy. Two list pointers (policydb.ocontexts[i] and policydb.genfs) were not being reset to NULL when the lists they pointed to were being freed. This caused a problem when the initial policy load failed, as the policydb being destroyed was not a temporary new policydb that was thrown away, but rather was the global (active) policydb. Consequently, later functions, particularly sys_bind->selinux_socket_bind->security_node_sid and do_rw_proc->selinux_sysctl->selinux_proc_get_sid->security_genfs_sid tried to dereference memory that had previously been freed.

Signed-off-by: Chad Sellers <csellers@tresys.com>

---
 security/selinux/ss/policydb.c |    2 ++
 1 file changed, 2 insertions(+)

Index: linux-2.6-discovery/security/selinux/ss/policydb.c
===================================================================
--- linux-2.6-discovery.orig/security/selinux/ss/policydb.c
+++ linux-2.6-discovery/security/selinux/ss/policydb.c
@@ -613,6 +613,7 @@ void policydb_destroy(struct policydb *p
 			c = c->next;
 			ocontext_destroy(ctmp,i);
 		}
+		p->ocontexts[i] = NULL;
 	}
 
 	g = p->genfs;
@@ -628,6 +629,7 @@ void policydb_destroy(struct policydb *p
 		g = g->next;
 		kfree(gtmp);
 	}
+	p->genfs = NULL;
 
 	cond_policydb_destroy(p);
 

--

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.