From: Colin Ian King <colin.king@canonical.com>
Date: Sun, 27 May 2018 22:55:10 +0000 (+0100)
Subject: EVM: Fix null dereference on xattr when xattr fails to allocate
X-Git-Tag: v4.18-rc1~100^2~2
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=72acd64df4561593d2ec3227b4aca9b0d7ded50e;p=uclinux-h8%2Flinux.git

EVM: Fix null dereference on xattr when xattr fails to allocate

In the case where the allocation of xattr fails and xattr is NULL, the
error exit return path via label 'out' will dereference xattr when
kfree'ing xattr-name.  Fix this by only kfree'ing xattr->name and xattr
when xattr is non-null.

Detected by CoverityScan, CID#1469366 ("Dereference after null check")

Fixes: fa516b66a1bf ("EVM: Allow runtime modification of the set of verified xattrs")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
---

diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c
index fb8bc950aceb..cf5cd303d7c0 100644
--- a/security/integrity/evm/evm_secfs.c
+++ b/security/integrity/evm/evm_secfs.c
@@ -253,8 +253,10 @@ static ssize_t evm_write_xattrs(struct file *file, const char __user *buf,
 out:
 	audit_log_format(ab, " res=%d", err);
 	audit_log_end(ab);
-	kfree(xattr->name);
-	kfree(xattr);
+	if (xattr) {
+		kfree(xattr->name);
+		kfree(xattr);
+	}
 	return err;
 }