Re: security: double-free in superblock_doinit

[Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>]

Dmitry Vyukov wrote:
> Hello,
> 
> I've got the following double-free report in superblock_doinit while
> running syzkaller fuzzer.
> Note the preceding injected failure in kmalloc, most likely that the root cause.

Thank you for reporting.

selinux_parse_opts_str() and smack_parse_opts_str() forgot to set
opts->mnt_opts to NULL after kfree() at

if (!opts->mnt_opts_flags) {
	kfree(opts->mnt_opts);
	goto out_err;
}

and caused double free at

if (opts->mnt_opts)
	for (i = 0; i < opts->num_mnt_opts; i++)
		kfree(opts->mnt_opts[i]);

in security_free_mnt_opts().
_______________________________________________
Selinux mailing list
Selinux@xxxxxxxxxxxxx
To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx.
To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.