Re: [PATCH] libselinux: restorecon_xattr: reset dir_xattr_list on every call

On Fri, Aug 7, 2026 at 8:32 AM Stephen Smalley
<[email protected]> wrote:
>
> On Thu, Aug 6, 2026 at 3:41 PM Vit Mojzis <[email protected]> wrote:
> >
> > selinux_restorecon_xattr(3) documents that "xattr_list must be set to
> > NULL before calling selinux_restorecon_xattr(3). The caller is
> > responsible for freeing the returned xattr_list entries." Commit
> > b5a23d7f30c1 ("libselinux: restorecon_xattr: clear dir_xattr_* after
> > freeing") reset the dir_xattr_list/dir_xattr_last statics after
> > freeing them on the internal error-cleanup path of the recursive
> > walk, but not on the normal success path.
> >
> > After a successful call, dir_xattr_list/dir_xattr_last are left
> > pointing at the just-returned, now caller-owned list. Once the caller
> > frees it as required and calls the function again, add_xattr_entry()
> > finds dir_xattr_list non-NULL and appends the next entry through
> > dir_xattr_last->next, a dangling pointer into memory the caller has
> > already freed - a use-after-free write.
> >
> > Reset both pointers to NULL at the top of every call instead of only
> > in the error path: by the API description, any list from a prior call
> > is not valid.
> >
> > Co-Authored-By: Claude Sonnet 5 <[email protected]>
> >
> > Signed-off-by: Vit Mojzis <[email protected]>
>
> Acked-by: Stephen Smalley <[email protected]>

Thanks, merged.