Re: [PATCH] checkpolicy: fix double free of fstype in define_genfs_context_helper

On Mon, Jul 13, 2026 at 10:15 AM Stephen Smalley
<[email protected]> wrote:
>
> On Fri, Jul 10, 2026 at 3:30 PM shafiuzzaman-md
> <[email protected]> wrote:
> >
> > From: Md Shafiuzzaman <[email protected]>
> >
> > When parsing a new filesystem type, define_genfs_context_helper() transfers
> > ownership of fstype into a genfs struct linked into the policydb's genfs
> > list, but does not clear the local fstype. A later goto fail then frees it,
> > leaving a dangling pointer that policydb_destroy() frees again.
> >
> > Clear fstype after the ownership transfer, mirroring the else branch.
> >
> > Reported-by: Md Shafiuzzaman <[email protected]>
> > Signed-off-by: Md Shafiuzzaman <[email protected]>
>
> Acked-by: Stephen Smalley <[email protected]>
>

This has been merged.
Thanks,
Jim

> > ---
> >  checkpolicy/policy_define.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
> > index 982de3f..3015782 100644
> > --- a/checkpolicy/policy_define.c
> > +++ b/checkpolicy/policy_define.c
> > @@ -6054,6 +6054,8 @@ static int define_genfs_context_helper(char *fstype, int has_type)
> >                         return -1;
> >                 }
> >                 newgenfs->fstype = fstype;
> > +               /* ownership transferred into the genfs list; do not free on error */
> > +               fstype = NULL;
> >                 newgenfs->next = genfs;
> >                 if (genfs_p)
> >                         genfs_p->next = newgenfs;
> > --
> > 2.54.0
> >
>