From 893c47d1964f5c9b00c5468f2cd1a1e9351fbb6a Mon Sep 17 00:00:00 2001 From: Austin Kim Date: Wed, 14 Jul 2021 01:11:27 +0100 Subject: selinux: return early for possible NULL audit buffers audit_log_start() may return NULL in below cases: - when audit is not initialized. - when audit backlog limit exceeds. After the call to audit_log_start() is made and then possible NULL audit buffer argument is passed to audit_log_*() functions, audit_log_*() functions return immediately in case of a NULL audit buffer argument. But it is optimal to return early when audit_log_start() returns NULL, because it is not necessary for audit_log_*() functions to be called with NULL audit buffer argument. So add exception handling for possible NULL audit buffers where return value can be handled from callers. Signed-off-by: Austin Kim [PM: tweak subject line] Signed-off-by: Paul Moore --- security/selinux/ss/services.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'security/selinux/ss') diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index d84c77f370dc..e5f1b2757a83 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -1673,6 +1673,8 @@ static int compute_sid_handle_invalid_context( if (context_struct_to_string(policydb, newcontext, &n, &nlen)) goto out; ab = audit_log_start(audit_context(), GFP_ATOMIC, AUDIT_SELINUX_ERR); + if (!ab) + goto out; audit_log_format(ab, "op=security_compute_sid invalid_context="); /* no need to record the NUL with untrusted strings */ -- cgit v1.2.3-59-g8ed1b