selinux: fix potential counting error in avc_add_xperms_decision()

Zhen Lei · pcmoore · commit 379d9af3f3da · 2024-08-06T17:52:27.000-04:00
The count increases only when a node is successfully added to the linked list. Cc: stable@vger.kernel.org Fixes: fa1aa14 ("selinux: extended permissions for ioctls") Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
@@ -330,12 +330,12 @@ static int avc_add_xperms_decision(struct avc_node *node,
 {
 	struct avc_xperms_decision_node *dest_xpd;
 
-	node->ae.xp_node->xp.len++;
 	dest_xpd = avc_xperms_decision_alloc(src->used);
 	if (!dest_xpd)
 		return -ENOMEM;
 	avc_copy_xperms_decision(&dest_xpd->xpd, src);
 	list_add(&dest_xpd->xpd_list, &node->ae.xp_node->xpd_head);
+	node->ae.xp_node->xp.len++;
 	return 0;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -330,12 +330,12 @@ static int avc_add_xperms_decision(struct avc_node *node,`
`330`	`330`	`{`
`331`	`331`	`struct avc_xperms_decision_node *dest_xpd;`
`332`	`332`
`333`		`- node->ae.xp_node->xp.len++;`
`334`	`333`	`dest_xpd = avc_xperms_decision_alloc(src->used);`
`335`	`334`	`if (!dest_xpd)`
`336`	`335`	`return -ENOMEM;`
`337`	`336`	`avc_copy_xperms_decision(&dest_xpd->xpd, src);`
`338`	`337`	`list_add(&dest_xpd->xpd_list, &node->ae.xp_node->xpd_head);`
	`338`	`+ node->ae.xp_node->xp.len++;`
`339`	`339`	`return 0;`
`340`	`340`	`}`
`341`	`341`