Merge tag 'selinux-pr-20220801' of git://git.kernel.org/pub/scm/linux/kernel/git...

[platform/kernel/linux-starfive.git] / security / selinux / hooks.c

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 1bbd533..7957350 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -640,7 +640,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
         * we need to skip the double mount verification.
         *
         * This does open a hole in which we will not notice if the first
-        * mount using this sb set explict options and a second mount using
+        * mount using this sb set explicit options and a second mount using
         * this sb does not set any security options.  (The first options
         * will be used for both mounts)
         */
@@ -944,10 +944,12 @@ out:
        return rc;
 }
 
+/*
+ * NOTE: the caller is resposible for freeing the memory even if on error.
+ */
 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 {
        struct selinux_mnt_opts *opts = *mnt_opts;
-       bool is_alloc_opts = false;
        u32 *dst_sid;
        int rc;
 
@@ -955,7 +957,7 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts)
                /* eaten and completely ignored */
                return 0;
        if (!s)
-               return -ENOMEM;
+               return -EINVAL;
 
        if (!selinux_initialized(&selinux_state)) {
                pr_warn("SELinux: Unable to set superblock options before the security server is initialized\n");
@@ -967,7 +969,6 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts)
                if (!opts)
                        return -ENOMEM;
                *mnt_opts = opts;
-               is_alloc_opts = true;
        }
 
        switch (token) {
@@ -1002,10 +1003,6 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts)
        return rc;
 
 err:
-       if (is_alloc_opts) {
-               kfree(opts);
-               *mnt_opts = NULL;
-       }
        pr_warn(SEL_MOUNT_FAIL_MSG);
        return -EINVAL;
 }
@@ -1019,7 +1016,7 @@ static int show_sid(struct seq_file *m, u32 sid)
        rc = security_sid_to_context(&selinux_state, sid,
                                             &context, &len);
        if (!rc) {
-               bool has_comma = context && strchr(context, ',');
+               bool has_comma = strchr(context, ',');
 
                seq_putc(m, '=');
                if (has_comma)
@@ -6792,7 +6789,7 @@ static u32 bpf_map_fmode_to_av(fmode_t fmode)
 }
 
 /* This function will check the file pass through unix socket or binder to see
- * if it is a bpf related object. And apply correspinding checks on the bpf
+ * if it is a bpf related object. And apply corresponding checks on the bpf
  * object based on the type. The bpf maps and programs, not like other files and
  * socket, are using a shared anonymous inode inside the kernel as their inode.
  * So checking that inode cannot identify if the process have privilege to