Commit 051143e1 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'apparmor-pr-2020-05-21' of...

Merge tag 'apparmor-pr-2020-05-21' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor

Pull apparmor bug fixes from John Johansen:

 - Fix use-after-free in aa_audit_rule_init

 - Fix refcnt leak in policy_update

 - Fix potential label refcnt leak in aa_change_profile

* tag 'apparmor-pr-2020-05-21' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:
  apparmor: Fix use-after-free in aa_audit_rule_init
  apparmor: Fix aa_label refcnt leak in policy_update
  apparmor: fix potential label refcnt leak in aa_change_profile
parents 907fa893 c54d481d
...@@ -454,7 +454,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size, ...@@ -454,7 +454,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
*/ */
error = aa_may_manage_policy(label, ns, mask); error = aa_may_manage_policy(label, ns, mask);
if (error) if (error)
return error; goto end_section;
data = aa_simple_write_to_buffer(buf, size, size, pos); data = aa_simple_write_to_buffer(buf, size, size, pos);
error = PTR_ERR(data); error = PTR_ERR(data);
...@@ -462,6 +462,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size, ...@@ -462,6 +462,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
error = aa_replace_profiles(ns, label, mask, data); error = aa_replace_profiles(ns, label, mask, data);
aa_put_loaddata(data); aa_put_loaddata(data);
} }
end_section:
end_current_label_crit_section(label); end_current_label_crit_section(label);
return error; return error;
......
...@@ -197,8 +197,9 @@ int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) ...@@ -197,8 +197,9 @@ int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr, rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
GFP_KERNEL, true, false); GFP_KERNEL, true, false);
if (IS_ERR(rule->label)) { if (IS_ERR(rule->label)) {
int err = PTR_ERR(rule->label);
aa_audit_rule_free(rule); aa_audit_rule_free(rule);
return PTR_ERR(rule->label); return err;
} }
*vrule = rule; *vrule = rule;
......
...@@ -1328,6 +1328,7 @@ int aa_change_profile(const char *fqname, int flags) ...@@ -1328,6 +1328,7 @@ int aa_change_profile(const char *fqname, int flags)
ctx->nnp = aa_get_label(label); ctx->nnp = aa_get_label(label);
if (!fqname || !*fqname) { if (!fqname || !*fqname) {
aa_put_label(label);
AA_DEBUG("no profile name"); AA_DEBUG("no profile name");
return -EINVAL; return -EINVAL;
} }
...@@ -1346,8 +1347,6 @@ int aa_change_profile(const char *fqname, int flags) ...@@ -1346,8 +1347,6 @@ int aa_change_profile(const char *fqname, int flags)
op = OP_CHANGE_PROFILE; op = OP_CHANGE_PROFILE;
} }
label = aa_get_current_label();
if (*fqname == '&') { if (*fqname == '&') {
stack = true; stack = true;
/* don't have label_parse() do stacking */ /* don't have label_parse() do stacking */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment