apparmor: Fix use-after-free in aa_audit_rule_init
commit c54d481d71c6849e044690d3960aaebc730224cc upstream.
In the implementation of aa_audit_rule_init(), when aa_label_parse()
fails the allocated memory for rule is released using
aa_audit_rule_free(). But after this release, the return statement
tries to access the label field of the rule which results in
use-after-free. Before releasing the rule, copy errNo and return it
after release.
Fixes: 52e8c38001
("apparmor: Fix memory leak of rule on error exit path")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
90389f4f54
commit
f1738ae012
@ -201,8 +201,9 @@ int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
|
||||
rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
|
||||
GFP_KERNEL, true, false);
|
||||
if (IS_ERR(rule->label)) {
|
||||
int err = PTR_ERR(rule->label);
|
||||
aa_audit_rule_free(rule);
|
||||
return PTR_ERR(rule->label);
|
||||
return err;
|
||||
}
|
||||
|
||||
*vrule = rule;
|
||||
|
Loading…
Reference in New Issue
Block a user