capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
Gaosheng Cui authored
commit 8cf0a1bc upstream.

In cap_inode_getsecurity(), we will use vfs_getxattr_alloc() to
complete the memory allocation of tmpbuf, if we have completed
the memory allocation of tmpbuf, but failed to call handler->get(...),
there will be a memleak in below logic:

  |-- ret = (int)vfs_getxattr_alloc(mnt_userns, ...)
    |           /* ^^^ alloc for tmpbuf */
    |-- value = krealloc(*xattr_value, error + 1, flags)
    |           /* ^^^ alloc memory */
    |-- error = handler->get(handler, ...)
    |           /* error! */
    |-- *xattr_value = value
    |           /* xattr_value is &tmpbuf (memory leak!) */

So we will try to free(tmpbuf) after vfs_getxattr_alloc() fails to fix it.

Cc: stable@vger.kernel.org
Fixes: 8db6c34f

 ("Introduce v3 namespaced file capabilities")
Signed-off-by: default avatarGaosheng Cui <cuigaosheng1@huawei.com>
Acked-by: default avatarSerge Hallyn <serge@hallyn.com>
[PM: subject line and backt...
2de8eec8
Name Last commit Last update
..
apparmor apparmor: Fix memleak in aa_simple_write_to_buffer()
bpf bpf: Implement task local storage
integrity ima: fix blocking of security.ima xattrs of unsupported algorithms
keys KEYS: trusted: tpm2: Fix migratable logic
landlock landlock: Fix same-layer rule unions
loadpin LSM: Add "contents" flag to kernel_read_file hook
lockdown Merge branch 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
safesetid LSM: SafeSetID: Mark safesetid_initialized as __initdata
selinux selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()
smack Fix incorrect type in assignment of ipv6 port for audit
tomoyo TOMOYO: fix __setup handlers return values
yama task_work: cleanup notification modes
Kconfig x86/retbleed: Add fine grained Kconfig knobs
Kconfig.hardening hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero
Makefile security: remove unneeded subdir-$(CONFIG_...)
commoncap.c capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
device_cgroup.c device_cgroup: Fix RCU list debugging warning
inode.c Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
lsm_audit.c audit: remove unnecessary 'ret' initialization
min_addr.c sysctl: pass kernel pointers to ->proc_handler
security.c lockdown: also lock down previous kgdb use