On 10/16/22 08:20, luhuaxin1@xxxxxxxxxx wrote:
From: Huaxin Lu <luhuaxin1@xxxxxxxxxx>
In restore_template_fmt, when kstrdup fails, a non-NULL value will still
be returned, which causes a NULL pointer access in template_desc_init_fields.
Co-authored-by: Jiaming Li <lijiaming30@xxxxxxxxxx>
Signed-off-by: Huaxin Lu <luhuaxin1@xxxxxxxxxx>
---
security/integrity/ima/ima_template.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c
index 07398f5..f81d4b2 100644
--- a/security/integrity/ima/ima_template.c
+++ b/security/integrity/ima/ima_template.c
@@ -295,8 +295,11 @@ static struct ima_template_desc *restore_template_fmt(char *template_name)
template_desc->name = "";
template_desc->fmt = kstrdup(template_name, GFP_KERNEL);
- if (!template_desc->fmt)
+ if (!template_desc->fmt) {
+ kfree(template_desc);
+ template_desc = NULL;
goto out;
+ }
spin_lock(&template_list);
list_add_tail_rcu(&template_desc->list, &defined_templates);
Reviewed-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>
