diff options
| author | Navid Emamdoost <navid.emamdoost@gmail.com> | 2019-10-21 10:23:47 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-05-27 17:37:37 +0200 |
| commit | f1738ae012a106c6c8fa7d33ed47fb478d9d3c75 (patch) | |
| tree | 95c4b0be6317c2bde9f8e5831fc1dc322dd87369 /security | |
| parent | 90389f4f54e8c383fff8ea9f5dc8140731426738 (diff) | |
| download | linux-stable-f1738ae012a106c6c8fa7d33ed47fb478d9d3c75.tar.gz linux-stable-f1738ae012a106c6c8fa7d33ed47fb478d9d3c75.tar.bz2 linux-stable-f1738ae012a106c6c8fa7d33ed47fb478d9d3c75.zip | |
apparmor: Fix use-after-free in aa_audit_rule_init
commit c54d481d71c6849e044690d3960aaebc730224cc upstream.
In the implementation of aa_audit_rule_init(), when aa_label_parse()
fails the allocated memory for rule is released using
aa_audit_rule_free(). But after this release, the return statement
tries to access the label field of the rule which results in
use-after-free. Before releasing the rule, copy errNo and return it
after release.
Fixes: 52e8c38001d8 ("apparmor: Fix memory leak of rule on error exit path")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/audit.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c index eeaddfe0c0fb..70b9730c0be6 100644 --- a/security/apparmor/audit.c +++ b/security/apparmor/audit.c @@ -201,8 +201,9 @@ int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr, GFP_KERNEL, true, false); if (IS_ERR(rule->label)) { + int err = PTR_ERR(rule->label); aa_audit_rule_free(rule); - return PTR_ERR(rule->label); + return err; } *vrule = rule; |