浏览代码

SELinux: if sel_make_bools errors don't leave inconsistent state

We reset the bool names and values array to NULL, but do not reset the
number of entries in these arrays to 0.  If we error out and then get back
into this function we will walk these NULL pointers based on the belief
that they are non-zero length.

Signed-off-by: Eric Paris <eparis@redhat.com>
cc: stable@kernel.org
Eric Paris 13 年之前
父节点
当前提交
154c50ca4e
共有 1 个文件被更改,包括 1 次插入0 次删除
  1. 1 0
      security/selinux/selinuxfs.c

+ 1 - 0
security/selinux/selinuxfs.c

@@ -1233,6 +1233,7 @@ static int sel_make_bools(void)
 		kfree(bool_pending_names[i]);
 	kfree(bool_pending_names);
 	kfree(bool_pending_values);
+	bool_num = 0;
 	bool_pending_names = NULL;
 	bool_pending_values = NULL;