apparmor: Fix use-after-free in aa_audit_rule_init
commitc54d481d71
upstream. In the implementation of aa_audit_rule_init(), when aa_label_parse() fails the allocated memory for rule is released using aa_audit_rule_free(). But after this release, the return statement tries to access the label field of the rule which results in use-after-free. Before releasing the rule, copy errNo and return it after release. Fixes:52e8c38001
("apparmor: Fix memory leak of rule on error exit path") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
3b1e38dfbc
commit
97d817b9ef
|
@ -197,8 +197,9 @@ int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
|
|||
rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
|
||||
GFP_KERNEL, true, false);
|
||||
if (IS_ERR(rule->label)) {
|
||||
int err = PTR_ERR(rule->label);
|
||||
aa_audit_rule_free(rule);
|
||||
return PTR_ERR(rule->label);
|
||||
return err;
|
||||
}
|
||||
|
||||
*vrule = rule;
|
||||
|
|
Loading…
Reference in New Issue