Re: [CHECKER] 32 Memory Leaks on Error Paths

[Chris Wright <chrisw@osdl.org>]

* David Yu Chen (dychen@stanford.edu) wrote:
> [FILE:  2.6.0-test5/security/selinux/ss/mls.c]
> [VAR:   r]
>  538:		goto out;
>  539:	}
>  540:	nel = le32_to_cpu(buf[0]);
>  541:	l = NULL;
>  542:	for (i = 0; i < nel; i++) {
> START -->
>  543:		r = kmalloc(sizeof(*r), GFP_ATOMIC);
>  544:		if (!r) {
>  545:			rc = -ENOMEM;
>  546:			goto out;
>  547:		}
>  548:		memset(r, 0, sizeof(*r));
>  549:
>  550:		rc = mls_read_range_helper(&r->range, fp);
>  551:		if (rc)
> GOTO -->
>  552:			goto out;

Yes, this looks like a bug.  Stephen, does this fix look ok?
thanks
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net


===== security/selinux/ss/mls.c 1.1 vs edited =====
--- 1.1/security/selinux/ss/mls.c	Thu Jul 17 02:38:01 2003
+++ edited/security/selinux/ss/mls.c	Fri Sep 19 13:56:50 2003
@@ -548,8 +548,10 @@
 		memset(r, 0, sizeof(*r));
 
 		rc = mls_read_range_helper(&r->range, fp);
-		if (rc)
+		if (rc) {
+			kfree(r);
 			goto out;
+		}
 
 		if (l)
 			l->next = r;