From: Zhongjun Tan <tanzhong...@yulong.com> In smack_sb_eat_lsm_opts(), 'arg' is allocated by kmemdup_nul(). It returns NULL when fails. So 'arg' should be checked. And 'mnt_opts' should be freed when error.
Signed-off-by: Zhongjun Tan <tanzhong...@yulong.com> --- changes in v1: update the commit information. changes in v2: fix brace error changes in v3: As viro said, just four codes and no other changes are needed. security/smack/smack_lsm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 223a6da..020929f 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -710,7 +710,10 @@ static int smack_sb_eat_lsm_opts(char *options, void **mnt_opts) token = match_opt_prefix(from, len, &arg); if (token != Opt_error) { arg = kmemdup_nul(arg, from + len - arg, GFP_KERNEL); - rc = smack_add_opt(token, arg, mnt_opts); + if (arg) + rc = smack_add_opt(token, arg, mnt_opts); + else + rc = -ENOMEM; if (unlikely(rc)) { kfree(arg); if (*mnt_opts) -- 1.9.1