capabilities: fix potential memleak on error path from vfs_getxattr_alloc()

8cf0a1bc · Gaosheng Cui <[email protected]> · 2022-10-25 21:33:57 +08:00

In cap_inode_getsecurity(), we will use vfs_getxattr_alloc() to
complete the memory allocation of tmpbuf, if we have completed
the memory allocation of tmpbuf, but failed to call handler->get(...),
there will be a memleak in below logic:

  |-- ret = (int)vfs_getxattr_alloc(mnt_userns, ...)
    |           /* ^^^ alloc for tmpbuf */
    |-- value = krealloc(*xattr_value, error + 1, flags)
    |           /* ^^^ alloc memory */
    |-- error = handler->get(handler, ...)
    |           /* error! */
    |-- *xattr_value = value
    |           /* xattr_value is &tmpbuf (memory leak!) */

So we will try to free(tmpbuf) after vfs_getxattr_alloc() fails to fix it.

Cc: [email protected]
Fixes: 8db6c34f1dbc ("Introduce v3 namespaced file capabilities")
Signed-off-by: Gaosheng Cui <[email protected]>
Acked-by: Serge Hallyn <[email protected]>
[PM: subject line and backtrace tweaks]
Signed-off-by: Paul Moore <[email protected]>

Commit

8cf0a1bc12870d148ae830a4ba88cfdf0e879cee

Parents

9abf2313

Changes

1 files changed · +4 −2