Messages in this thread Patch in this message | | | From | Navid Emamdoost <> | Subject | [PATCH] apparmor: Fix use-after-free in aa_audit_rule_init | Date | Wed, 16 Oct 2019 20:46:18 -0500 |
| |
In the implementation of aa_audit_rule_init(), when aa_label_parse() fails the allocated memory for rule is released using aa_audit_rule_free(). But after this release the the return statement tries to access the label field of the rule which results in use-after-free. Before releaseing the rule, copy errNo and return it after releasing rule.
Fixes: 52e8c38001d8 ("apparmor: Fix memory leak of rule on error exit path") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> --- security/apparmor/audit.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c index 5a98661a8b46..48c15fb0aafe 100644 --- a/security/apparmor/audit.c +++ b/security/apparmor/audit.c @@ -178,6 +178,7 @@ void aa_audit_rule_free(void *vrule) int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) { struct aa_audit_rule *rule; + int err; switch (field) { case AUDIT_SUBJ_ROLE: @@ -197,8 +198,9 @@ int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr, GFP_KERNEL, true, false); if (IS_ERR(rule->label)) { + err = rule->label; aa_audit_rule_free(rule); - return PTR_ERR(rule->label); + return PTR_ERR(err); } *vrule = rule; -- 2.17.1
| |