selinux: fix a missing-check bug in selinux_sb_eat_lsm_opts()

In selinux_sb_eat_lsm_opts(), 'arg' is allocated by kmemdup_nul(). It
returns NULL when fails. So 'arg' should be checked. And 'mnt_opts'
should be freed when error.

Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
Fixes: 99dbbb593fe6 ("selinux: rewrite selinux_sb_eat_lsm_opts()")
Cc: <stable@vger.kernel.org>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index b7db84c97882b3788ce3607429a114bd13558418..fea66f6b31bf50435519fcd324ed54e3a785bb2f 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2625,10 +2625,11 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
        char *from = options;
        char *to = options;
        bool first = true;
+       int rc;
 
        while (1) {
                int len = opt_len(from);
-               int token, rc;
+               int token;
                char *arg = NULL;
 
                token = match_opt_prefix(from, len, &arg);
@@ -2644,15 +2645,15 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
                                                *q++ = c;
                                }
                                arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
+                               if (!arg) {
+                                       rc = -ENOMEM;
+                                       goto free_opt;
+                               }
                        }
                        rc = selinux_add_opt(token, arg, mnt_opts);
                        if (unlikely(rc)) {
                                kfree(arg);
-                               if (*mnt_opts) {
-                                       selinux_free_mnt_opts(*mnt_opts);
-                                       *mnt_opts = NULL;
-                               }
-                               return rc;
+                               goto free_opt;
                        }
                } else {
                        if (!first) {   // copy with preceding comma
@@ -2670,6 +2671,13 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
        }
        *to = '\0';
        return 0;
+
+free_opt:
+       if (*mnt_opts) {
+               selinux_free_mnt_opts(*mnt_opts);
+               *mnt_opts = NULL;
+       }
+       return rc;
 }
 
 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)