On Fri, Feb 14, 2020 at 11:07:37AM -0500, Stephen Smalley wrote:
On 2/14/20 10:43 AM, Sasha Levin wrote:From: Paul Moore <paul@xxxxxxxxxxxxxx> [ Upstream commit d8db60cb23e49a92cf8cada3297395c7fa50fdf8 ] Fix avc_insert() to call avc_node_kill() if we've already allocated an AVC node and the code fails to insert the node in the cache. Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls") Reported-by: rsiddoji@xxxxxxxxxxxxxx Suggested-by: Stephen Smalley <sds@xxxxxxxxxxxxx> Acked-by: Stephen Smalley <sds@xxxxxxxxxxxxx> Signed-off-by: Paul Moore <paul@xxxxxxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>You should also apply 030b995ad9ece9fa2d218af4429c1c78c2342096 ("selinux: ensure we cleanup the internal AVC counters on error in avc_update()") which fixes one additional instance of the same kind of bug not addressed by this patch.
I took that patch as well, thank you. -- Thanks, Sasha
