From owner-svn-src-all@FreeBSD.ORG Sun Apr 8 11:01:49 2012 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id C07B9106564A; Sun, 8 Apr 2012 11:01:49 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 9FF588FC08; Sun, 8 Apr 2012 11:01:49 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q38B1n9i008907; Sun, 8 Apr 2012 11:01:49 GMT (envelope-from rwatson@svn.freebsd.org) Received: (from rwatson@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q38B1nhN008905; Sun, 8 Apr 2012 11:01:49 GMT (envelope-from rwatson@svn.freebsd.org) Message-Id: <201204081101.q38B1nhN008905@svn.freebsd.org> From: Robert Watson Date: Sun, 8 Apr 2012 11:01:49 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r234032 - head/sys/security/mac X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Apr 2012 11:01:49 -0000 Author: rwatson Date: Sun Apr 8 11:01:49 2012 New Revision: 234032 URL: http://svn.freebsd.org/changeset/base/234032 Log: When allocation of labels on files is implicitly disabled due to MAC policy configuration, avoid leaking resources following failed calls to get and set MAC labels by file descriptor. Reported by: Mateusz Guzik + clang scan-build MFC after: 3 days Modified: head/sys/security/mac/mac_syscalls.c Modified: head/sys/security/mac/mac_syscalls.c ============================================================================== --- head/sys/security/mac/mac_syscalls.c Sun Apr 8 10:15:56 2012 (r234031) +++ head/sys/security/mac/mac_syscalls.c Sun Apr 8 11:01:49 2012 (r234032) @@ -256,8 +256,10 @@ sys___mac_get_fd(struct thread *td, stru switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: - if (!(mac_labeled & MPC_OBJECT_VNODE)) - return (EINVAL); + if (!(mac_labeled & MPC_OBJECT_VNODE)) { + error = EINVAL; + goto out_fdrop; + } vp = fp->f_vnode; intlabel = mac_vnode_label_alloc(); vfslocked = VFS_LOCK_GIANT(vp->v_mount); @@ -271,8 +273,10 @@ sys___mac_get_fd(struct thread *td, stru break; case DTYPE_PIPE: - if (!(mac_labeled & MPC_OBJECT_PIPE)) - return (EINVAL); + if (!(mac_labeled & MPC_OBJECT_PIPE)) { + error = EINVAL; + goto out_fdrop; + } pipe = fp->f_data; intlabel = mac_pipe_label_alloc(); PIPE_LOCK(pipe); @@ -284,8 +288,10 @@ sys___mac_get_fd(struct thread *td, stru break; case DTYPE_SOCKET: - if (!(mac_labeled & MPC_OBJECT_SOCKET)) - return (EINVAL); + if (!(mac_labeled & MPC_OBJECT_SOCKET)) { + error = EINVAL; + goto out_fdrop; + } so = fp->f_data; intlabel = mac_socket_label_alloc(M_WAITOK); SOCK_LOCK(so); @@ -299,10 +305,10 @@ sys___mac_get_fd(struct thread *td, stru default: error = EINVAL; } - fdrop(fp, td); if (error == 0) error = copyout(buffer, mac.m_string, strlen(buffer)+1); - +out_fdrop: + fdrop(fp, td); out: free(buffer, M_MACTEMP); free(elements, M_MACTEMP); @@ -450,8 +456,10 @@ sys___mac_set_fd(struct thread *td, stru switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: - if (!(mac_labeled & MPC_OBJECT_VNODE)) - return (EINVAL); + if (!(mac_labeled & MPC_OBJECT_VNODE)) { + error = EINVAL; + goto out_fdrop; + } intlabel = mac_vnode_label_alloc(); error = mac_vnode_internalize_label(intlabel, buffer); if (error) { @@ -475,8 +483,10 @@ sys___mac_set_fd(struct thread *td, stru break; case DTYPE_PIPE: - if (!(mac_labeled & MPC_OBJECT_PIPE)) - return (EINVAL); + if (!(mac_labeled & MPC_OBJECT_PIPE)) { + error = EINVAL; + goto out_fdrop; + } intlabel = mac_pipe_label_alloc(); error = mac_pipe_internalize_label(intlabel, buffer); if (error == 0) { @@ -490,8 +500,10 @@ sys___mac_set_fd(struct thread *td, stru break; case DTYPE_SOCKET: - if (!(mac_labeled & MPC_OBJECT_SOCKET)) - return (EINVAL); + if (!(mac_labeled & MPC_OBJECT_SOCKET)) { + error = EINVAL; + goto out_fdrop; + } intlabel = mac_socket_label_alloc(M_WAITOK); error = mac_socket_internalize_label(intlabel, buffer); if (error == 0) { @@ -505,6 +517,7 @@ sys___mac_set_fd(struct thread *td, stru default: error = EINVAL; } +out_fdrop: fdrop(fp, td); out: free(buffer, M_MACTEMP);