From bde4941613d80cd2f80c3a77963723b99e9591df Mon Sep 17 00:00:00 2001 From: palazik Date: Sat, 11 Jul 2026 18:13:32 +0500 Subject: [PATCH] kernel: add missing NULL checks on allocation paths Two allocation sites dereferenced their result without checking for failure, which panics the kernel under memory pressure: - throne_tracker.c: search_manager()'s directory actor allocated a new apk_path_hash node and immediately wrote to it. Skip the entry (like the existing data_path allocation a few lines above) when allocation fails. - sepolicy.c: add_filename_trans() allocated a filename_trans_datum, a filename_trans_key, and kstrdup'd the name, then dereferenced all three unconditionally. Bail out (returning false) and free the partial allocations on failure. --- kernel/manager/throne_tracker.c | 4 ++++ kernel/selinux/sepolicy.c | 15 +++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/kernel/manager/throne_tracker.c b/kernel/manager/throne_tracker.c index 1f0360e64f13..f10d011990fe 100644 --- a/kernel/manager/throne_tracker.c +++ b/kernel/manager/throne_tracker.c @@ -143,6 +143,10 @@ FILLDIR_RETURN_TYPE my_actor(struct dir_context *ctx, const char *name, int name } } else { struct apk_path_hash *apk_data = kzalloc(sizeof(struct apk_path_hash), GFP_KERNEL); + if (!apk_data) { + pr_err("Failed to allocate apk_path_hash for %s\n", dirpath); + return FILLDIR_ACTOR_CONTINUE; + } apk_data->hash = hash; apk_data->exists = true; list_add_tail(&apk_data->list, &apk_path_hash_list); diff --git a/kernel/selinux/sepolicy.c b/kernel/selinux/sepolicy.c index 6bd3df186bd9..47e567918596 100644 --- a/kernel/selinux/sepolicy.c +++ b/kernel/selinux/sepolicy.c @@ -586,9 +586,24 @@ static bool add_filename_trans(struct policydb *db, const char *s, const char *t if (trans == NULL) { trans = (struct filename_trans_datum *)kcalloc(1, sizeof(*trans), GFP_KERNEL); + if (!trans) { + pr_err("add_filename_trans: alloc filename_trans_datum failed\n"); + return false; + } struct filename_trans_key *new_key = (struct filename_trans_key *)kzalloc(sizeof(*new_key), GFP_KERNEL); + if (!new_key) { + pr_err("add_filename_trans: alloc filename_trans_key failed\n"); + kfree(trans); + return false; + } *new_key = key; new_key->name = kstrdup(key.name, GFP_KERNEL); + if (!new_key->name) { + pr_err("add_filename_trans: kstrdup name failed\n"); + kfree(new_key); + kfree(trans); + return false; + } trans->next = last; trans->otype = def->value; hashtab_insert(&db->filename_trans, new_key, trans, filenametr_key_params);