Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1607344

Re: security: double-free in superblock_doinit

Show all headers | View raw

Dmitry Vyukov wrote:
> Hello,
> 
> I've got the following double-free report in superblock_doinit while
> running syzkaller fuzzer.
> Note the preceding injected failure in kmalloc, most likely that the root cause.

Thank you for reporting.

selinux_parse_opts_str() and smack_parse_opts_str() forgot to set
opts->mnt_opts to NULL after kfree() at

if (!opts->mnt_opts_flags) {
	kfree(opts->mnt_opts);
	goto out_err;
}

and caused double free at

if (opts->mnt_opts)
	for (i = 0; i < opts->num_mnt_opts; i++)
		kfree(opts->mnt_opts[i]);

in security_free_mnt_opts().

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

security: double-free in superblock_doinit Dmitry Vyukov <dvyukov@google.com> - 2017-03-23 11:30 +0100
  Re: security: double-free in superblock_doinit Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> - 2017-03-23 11:50 +0100

csiph-web