EVM: Fix null dereference on xattr when xattr fails to allocate

In the case where the allocation of xattr fails and xattr is NULL, the
error exit return path via label 'out' will dereference xattr when
kfree'ing xattr-name.  Fix this by only kfree'ing xattr->name and xattr
when xattr is non-null.

Detected by CoverityScan, CID#1469366 ("Dereference after null check")

Fixes: fa516b66a1bf ("EVM: Allow runtime modification of the set of verified xattrs")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c
index fb8bc950aceb44d234ee469e43c3ff674c90e535..cf5cd303d7c074a89643d70f31f3949c579bac84 100644 (file)
--- a/security/integrity/evm/evm_secfs.c
+++ b/security/integrity/evm/evm_secfs.c
@@ -253,8 +253,10 @@ static ssize_t evm_write_xattrs(struct file *file, const char __user *buf,
 out:
        audit_log_format(ab, " res=%d", err);
        audit_log_end(ab);
-       kfree(xattr->name);
-       kfree(xattr);
+       if (xattr) {
+               kfree(xattr->name);
+               kfree(xattr);
+       }
        return err;
 }