Merge tag 'selinux-pr-20190917' of git://git.kernel.org/pub/scm/linux/kernel/git...

[platform/kernel/linux-rpi.git] / security / selinux / netif.c

diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index 9cb83ee..e40fecd 100644 (file)
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -132,9 +132,9 @@ static void sel_netif_destroy(struct sel_netif *netif)
  */
 static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
 {
-       int ret;
+       int ret = 0;
        struct sel_netif *netif;
-       struct sel_netif *new = NULL;
+       struct sel_netif *new;
        struct net_device *dev;
 
        /* NOTE: we always use init's network namespace since we don't
@@ -151,32 +151,27 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
        netif = sel_netif_find(ns, ifindex);
        if (netif != NULL) {
                *sid = netif->nsec.sid;
-               ret = 0;
                goto out;
        }
-       new = kzalloc(sizeof(*new), GFP_ATOMIC);
-       if (new == NULL) {
-               ret = -ENOMEM;
-               goto out;
-       }
-       ret = security_netif_sid(&selinux_state, dev->name, &new->nsec.sid);
-       if (ret != 0)
-               goto out;
-       new->nsec.ns = ns;
-       new->nsec.ifindex = ifindex;
-       ret = sel_netif_insert(new);
+
+       ret = security_netif_sid(&selinux_state, dev->name, sid);
        if (ret != 0)
                goto out;
-       *sid = new->nsec.sid;
+       new = kzalloc(sizeof(*new), GFP_ATOMIC);
+       if (new) {
+               new->nsec.ns = ns;
+               new->nsec.ifindex = ifindex;
+               new->nsec.sid = *sid;
+               if (sel_netif_insert(new))
+                       kfree(new);
+       }
 
 out:
        spin_unlock_bh(&sel_netif_lock);
        dev_put(dev);
-       if (unlikely(ret)) {
+       if (unlikely(ret))
                pr_warn("SELinux: failure in %s(), unable to determine network interface label (%d)\n",
                        __func__, ifindex);
-               kfree(new);
-       }
        return ret;
 }