2 files changed, 7 insertions, 3 deletions
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 8eb140dd2e4b..a45cc971e735 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -879,7 +879,7 @@ static ssize_t sel_commit_bools_write(struct file *filep,
        if (sscanf(page, "%d", &new_value) != 1)
                goto out;
-        if (new_value) {
+        if (new_value && bool_pending_values) {
                security_set_bools(bool_num, bool_pending_values);
        }
@@ -952,6 +952,7 @@ static int sel_make_bools(void)
        /* remove any existing files */
        kfree(bool_pending_values);
+        bool_pending_values = NULL;
        sel_remove_bools(dir);
@@ -1002,6 +1003,7 @@ out:
        }
        return ret;
 err:
+        kfree(values);
        d_genocide(dir);
        ret = -ENOMEM;
        goto out;
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 0a758323a9cf..8e6262d12aa9 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -650,8 +650,10 @@ void policydb_destroy(struct policydb *p)
        }
        if (lrt) kfree(lrt);
-        for (i = 0; i < p->p_types.nprim; i++)
+        if (p->type_attr_map) {
-                ebitmap_destroy(&p->type_attr_map[i]);
+                for (i = 0; i < p->p_types.nprim; i++)
+                        ebitmap_destroy(&p->type_attr_map[i]);
+        }
        kfree(p->type_attr_map);
        return;