2 files changed, 7 insertions, 3 deletions

diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 8eb140dd2e4b..a45cc971e735 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -879,7 +879,7 @@ static ssize_t sel_commit_bools_write(struct file *filep,
         if (sscanf(page, "%d", &new_value) != 1)
                 goto out;
 
-        if (new_value) {
+        if (new_value && bool_pending_values) {
                 security_set_bools(bool_num, bool_pending_values);
         }
 
@@ -952,6 +952,7 @@ static int sel_make_bools(void)
 
         /* remove any existing files */
         kfree(bool_pending_values);
+        bool_pending_values = NULL;
 
         sel_remove_bools(dir);
 
@@ -1002,6 +1003,7 @@ out:
         }
         return ret;
 err:
+        kfree(values);
         d_genocide(dir);
         ret = -ENOMEM;
         goto out;
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 0a758323a9cf..8e6262d12aa9 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -650,8 +650,10 @@ void policydb_destroy(struct policydb *p)
         }
         if (lrt) kfree(lrt);
 
-        for (i = 0; i < p->p_types.nprim; i++)
-                ebitmap_destroy(&p->type_attr_map[i]);
+        if (p->type_attr_map) {
+                for (i = 0; i < p->p_types.nprim; i++)
+                        ebitmap_destroy(&p->type_attr_map[i]);
+        }
         kfree(p->type_attr_map);
 
         return;