Commit 051143e1 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'apparmor-pr-2020-05-21' of... 

Merge tag 'apparmor-pr-2020-05-21' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor

Pull apparmor bug fixes from John Johansen:

 - Fix use-after-free in aa_audit_rule_init

 - Fix refcnt leak in policy_update

 - Fix potential label refcnt leak in aa_change_profile

* tag 'apparmor-pr-2020-05-21' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:
  apparmor: Fix use-after-free in aa_audit_rule_init
  apparmor: Fix aa_label refcnt leak in policy_update
  apparmor: fix potential label refcnt leak in aa_change_profile
parents 907fa893 c54d481d

security/apparmor/apparmorfs.c

+2 −1
Original line number Diff line number Diff line
@@ -454,7 +454,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size, 
	 */

	error = aa_may_manage_policy(label, ns, mask);

	if (error)

		return error;

		goto end_section;



	data = aa_simple_write_to_buffer(buf, size, size, pos);

	error = PTR_ERR(data);
@@ -462,6 +462,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size, 
		error = aa_replace_profiles(ns, label, mask, data);

		aa_put_loaddata(data);

	}

end_section:

	end_current_label_crit_section(label);



	return error;

security/apparmor/audit.c

+2 −1
Original line number Diff line number Diff line
@@ -197,8 +197,9 @@ int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) 
	rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,

				     GFP_KERNEL, true, false);

	if (IS_ERR(rule->label)) {

		int err = PTR_ERR(rule->label);

		aa_audit_rule_free(rule);

		return PTR_ERR(rule->label);

		return err;

	}



	*vrule = rule;

security/apparmor/domain.c

+1 −2
Original line number Diff line number Diff line
@@ -1328,6 +1328,7 @@ int aa_change_profile(const char *fqname, int flags) 
		ctx->nnp = aa_get_label(label);



	if (!fqname || !*fqname) {

		aa_put_label(label);

		AA_DEBUG("no profile name");

		return -EINVAL;

	}
@@ -1346,8 +1347,6 @@ int aa_change_profile(const char *fqname, int flags) 
			op = OP_CHANGE_PROFILE;

	}



	label = aa_get_current_label();



	if (*fqname == '&') {

		stack = true;

		/* don't have label_parse() do stacking */

CRA Git | Maintained and supported by SUSTech CRA and CCSE