Re: [PATCH] checkpolicy: fix double free of fstype in define_genfs_context_helper

On Fri, Jul 10, 2026 at 3:30 PM shafiuzzaman-md
<[email protected]> wrote:
>
> From: Md Shafiuzzaman <[email protected]>
>
> When parsing a new filesystem type, define_genfs_context_helper() transfers
> ownership of fstype into a genfs struct linked into the policydb's genfs
> list, but does not clear the local fstype. A later goto fail then frees it,
> leaving a dangling pointer that policydb_destroy() frees again.
>
> Clear fstype after the ownership transfer, mirroring the else branch.
>
> Reported-by: Md Shafiuzzaman <[email protected]>
> Signed-off-by: Md Shafiuzzaman <[email protected]>

Acked-by: Stephen Smalley <[email protected]>

> ---
>  checkpolicy/policy_define.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
> index 982de3f..3015782 100644
> --- a/checkpolicy/policy_define.c
> +++ b/checkpolicy/policy_define.c
> @@ -6054,6 +6054,8 @@ static int define_genfs_context_helper(char *fstype, int has_type)
>                         return -1;
>                 }
>                 newgenfs->fstype = fstype;
> +               /* ownership transferred into the genfs list; do not free on error */
> +               fstype = NULL;
>                 newgenfs->next = genfs;
>                 if (genfs_p)
>                         genfs_p->next = newgenfs;
> --
> 2.54.0
>