[PATCH v2] apparmor: Fix use-after-free in aa_audit_rule_init

[kbuild test robot]

Hi Navid,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on security/next-testing]
[cannot apply to v5.4-rc4 next-20191023]
[if your patch is applied to the wrong git tree, please drop us a note to help
improve the system. BTW, we also suggest to use '--base' option to specify the
base tree in git format-patch, please see https://stackoverflow.com/a/37406982]

url:    https://github.com/0day-ci/linux/commits/Navid-Emamdoost/apparmor-Fix-use-after-free-in-aa_audit_rule_init/20191024-123239
base:   https://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next-testing
config: ia64-allmodconfig (attached as .config)
compiler: ia64-linux-gcc (GCC) 7.4.0
reproduce:
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # save the attached .config to linux build tree
        GCC_VERSION=7.4.0 make.cross ARCH=ia64 

If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp at intel.com>

All warnings (new ones prefixed by >>):

   security/apparmor/audit.c: In function 'aa_audit_rule_init':
>> security/apparmor/audit.c:200:13: warning: initialization makes integer from pointer without a cast [-Wint-conversion]
      int err = rule->label;
                ^~~~
>> security/apparmor/audit.c:202:18: warning: passing argument 1 of 'PTR_ERR' makes pointer from integer without a cast [-Wint-conversion]
      return PTR_ERR(err);
                     ^~~
   In file included from include/linux/rwsem.h:18:0,
                    from include/linux/key.h:18,
                    from include/linux/cred.h:13,
                    from include/linux/sched/signal.h:10,
                    from include/linux/ptrace.h:7,
                    from include/linux/audit.h:13,
                    from security/apparmor/audit.c:11:
   include/linux/err.h:29:33: note: expected 'const void *' but argument is of type 'int'
    static inline long __must_check PTR_ERR(__force const void *ptr)
                                    ^~~~~~~

vim +200 security/apparmor/audit.c

   177	
   178	int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
   179	{
   180		struct aa_audit_rule *rule;
   181	
   182		switch (field) {
   183		case AUDIT_SUBJ_ROLE:
   184			if (op != Audit_equal && op != Audit_not_equal)
   185				return -EINVAL;
   186			break;
   187		default:
   188			return -EINVAL;
   189		}
   190	
   191		rule = kzalloc(sizeof(struct aa_audit_rule), GFP_KERNEL);
   192	
   193		if (!rule)
   194			return -ENOMEM;
   195	
   196		/* Currently rules are treated as coming from the root ns */
   197		rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
   198					     GFP_KERNEL, true, false);
   199		if (IS_ERR(rule->label)) {
 > 200			int err = rule->label;
   201			aa_audit_rule_free(rule);
 > 202			return PTR_ERR(err);
   203		}
   204	
   205		*vrule = rule;
   206		return 0;
   207	}
   208	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation