lkml.org 
[lkml]   [2022]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 299/389] apparmor: fix reference count leak in aa_pivotroot()
    Date
    From: Xin Xiong <xiongx18@fudan.edu.cn>

    commit 11c3627ec6b56c1525013f336f41b79a983b4d46 upstream.

    The aa_pivotroot() function has a reference counting bug in a specific
    path. When aa_replace_current_label() returns on success, the function
    forgets to decrement the reference count of “target”, which is
    increased earlier by build_pivotroot(), causing a reference leak.

    Fix it by decreasing the refcount of “target” in that path.

    Fixes: 2ea3ffb7782a ("apparmor: add mount mediation")
    Co-developed-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
    Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
    Co-developed-by: Xin Tan <tanxin.ctf@gmail.com>
    Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
    Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    security/apparmor/mount.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/security/apparmor/mount.c
    +++ b/security/apparmor/mount.c
    @@ -683,6 +683,7 @@ int aa_pivotroot(struct aa_label *label,
    aa_put_label(target);
    goto out;
    }
    + aa_put_label(target);
    } else
    /* already audited error */
    error = PTR_ERR(target);

    \
     
     \ /
      Last update: 2022-08-23 13:55    [W:2.409 / U:0.700 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site