apparmor: Fix use-after-free in aa_audit_rule_init
commit5.4-rM2-2.2.x-imx-squashedc54d481d71
upstream. In the implementation of aa_audit_rule_init(), when aa_label_parse() fails the allocated memory for rule is released using aa_audit_rule_free(). But after this release, the return statement tries to access the label field of the rule which results in use-after-free. Before releasing the rule, copy errNo and return it after release. Fixes:52e8c38001
("apparmor: Fix memory leak of rule on error exit path") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
3b1e38dfbc
commit
97d817b9ef
|
@ -197,8 +197,9 @@ int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
|
||||||
rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
|
rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
|
||||||
GFP_KERNEL, true, false);
|
GFP_KERNEL, true, false);
|
||||||
if (IS_ERR(rule->label)) {
|
if (IS_ERR(rule->label)) {
|
||||||
|
int err = PTR_ERR(rule->label);
|
||||||
aa_audit_rule_free(rule);
|
aa_audit_rule_free(rule);
|
||||||
return PTR_ERR(rule->label);
|
return err;
|
||||||
}
|
}
|
||||||
|
|
||||||
*vrule = rule;
|
*vrule = rule;
|
||||||
|
|
Loading…
Reference in New Issue