selinux: ensure we cleanup the internal AVC counters on error in avc_insert()

Browse source

[ Upstream commit d8db60cb23 ]

Fix avc_insert() to call avc_node_kill() if we've already allocated
an AVC node and the code fails to insert the node in the cache.

Fixes: fa1aa143ac ("selinux: extended permissions for ioctls")
Reported-by: rsiddoji@codeaurora.org
Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Paul Moore 2019-12-09 20:39:46 -05:00 • committed by Greg Kroah-Hartman

parent 06389f62ef

commit 7b94c9965c

1 changed files with 24 additions and 27 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

53

security/selinux/avc.c

View file