selinux: set next pointer before attaching to list
commit70d91dc9b2
upstream. Set the next pointer in filename_trans_read_helper() before attaching the new node under construction to the list, otherwise garbage would be dereferenced on subsequent failure during cleanup in the out goto label. Cc: <stable@vger.kernel.org> Fixes:4300590243
("selinux: implement new format of filename transitions") Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
36c5aecc78
commit
d6b64d710e
|
@ -2005,6 +2005,7 @@ static int filename_trans_read_helper(struct policydb *p, void *fp)
|
||||||
if (!datum)
|
if (!datum)
|
||||||
goto out;
|
goto out;
|
||||||
|
|
||||||
|
datum->next = NULL;
|
||||||
*dst = datum;
|
*dst = datum;
|
||||||
|
|
||||||
/* ebitmap_read() will at least init the bitmap */
|
/* ebitmap_read() will at least init the bitmap */
|
||||||
|
@ -2017,7 +2018,6 @@ static int filename_trans_read_helper(struct policydb *p, void *fp)
|
||||||
goto out;
|
goto out;
|
||||||
|
|
||||||
datum->otype = le32_to_cpu(buf[0]);
|
datum->otype = le32_to_cpu(buf[0]);
|
||||||
datum->next = NULL;
|
|
||||||
|
|
||||||
dst = &datum->next;
|
dst = &datum->next;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue