apparmor: fix invalid reference to index variable of iterator line 836 (b9b144bc) · Commits · 戴 / test

Once the loop on lines 836-853 is complete and exits normally, ent is a pointer to the dummy list head value. The derefernces accessible from eg the goto fail on line 860 or the various goto fail_lock's afterwards thus seem incorrect. Reported-by:

Julia Lawall <julia.lawall@lip6.fr> Signed-off-by:

John Johansen <john.johansen@canonical.com> Signed-off-by:

James Morris <james.l.morris@oracle.com>

security/apparmor/policy.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -876,9 +876,11 @@ ssize_t aa_replace_profiles(struct aa_ns view, struct aa_profile profile,
		if (ns_name) {
		ns = aa_prepare_ns(view, ns_name);
		if (IS_ERR(ns)) {
		op = OP_PROF_LOAD;
		info = "failed to prepare namespace";
		error = PTR_ERR(ns);
		ns = NULL;
		ent = NULL;
		goto fail;
		}
		} else
		@@ -1013,7 +1015,7 @@ fail_lock:
		/* audit cause of failure */
		op = (!ent->old) ? OP_PROF_LOAD : OP_PROF_REPL;
		fail:
		audit_policy(profile, op, ns_name, ent->new->base.hname,
		audit_policy(profile, op, ns_name, ent ? ent->new->base.hname : NULL,
		info, error);
		/* audit status that rest of profiles in the atomic set failed too */
		info = "valid profile in failed atomic policy load";
		@@ -1023,7 +1025,7 @@ fail:
		/* skip entry that caused failure */
		continue;
		}
		op = (!ent->old) ? OP_PROF_LOAD : OP_PROF_REPL;
		op = (!tmp->old) ? OP_PROF_LOAD : OP_PROF_REPL;
		audit_policy(profile, op, ns_name,
		tmp->new->base.hname, info, error);
		}

Admin message