Commit 37801a36 authored by Christian Göttsche's avatar Christian Göttsche Committed by Paul Moore
Browse files

selinux: avoid dereference of garbage after mount failure 



In case kern_mount() fails and returns an error pointer return in the
error branch instead of continuing and dereferencing the error pointer.

While on it drop the never read static variable selinuxfs_mount.

Cc: stable@vger.kernel.org
Fixes: 0619f0f5 ("selinux: wrap selinuxfs state")
Signed-off-by: default avatarChristian Göttsche <cgzones@googlemail.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 4cece764

security/selinux/selinuxfs.c

+7 −5
Original line number Diff line number Diff line
@@ -2123,7 +2123,6 @@ static struct file_system_type sel_fs_type = { 
	.kill_sb	= sel_kill_sb,

};



static struct vfsmount *selinuxfs_mount __ro_after_init;

struct path selinux_null __ro_after_init;



static int __init init_sel_fs(void)
@@ -2145,18 +2144,21 @@ static int __init init_sel_fs(void) 
		return err;

	}



	selinux_null.mnt = selinuxfs_mount = kern_mount(&sel_fs_type);

	if (IS_ERR(selinuxfs_mount)) {

	selinux_null.mnt = kern_mount(&sel_fs_type);

	if (IS_ERR(selinux_null.mnt)) {

		pr_err("selinuxfs:  could not mount!\n");

		err = PTR_ERR(selinuxfs_mount);

		selinuxfs_mount = NULL;

		err = PTR_ERR(selinux_null.mnt);

		selinux_null.mnt = NULL;

		return err;

	}



	selinux_null.dentry = d_hash_and_lookup(selinux_null.mnt->mnt_root,

						&null_name);

	if (IS_ERR(selinux_null.dentry)) {

		pr_err("selinuxfs:  could not lookup null!\n");

		err = PTR_ERR(selinux_null.dentry);

		selinux_null.dentry = NULL;

		return err;

	}



	return err;