[PATCH] apparmor: Fix memory leak in unpack_profile()

[John Johansen]

On 1/4/24 18:01, Gaosheng Cui wrote:
> The aa_put_pdb(rules->file) should be called when rules->file is
> reassigned, otherwise there may be a memory leak.
> 
> This was found via kmemleak:
> 
> unreferenced object 0xffff986c17056600 (size 192):
>    comm "apparmor_parser", pid 875, jiffies 4294893488
>    hex dump (first 32 bytes):
>      00 00 00 00 00 00 00 00 00 89 14 04 6c 98 ff ff  ............l...
>      00 00 8c 11 6c 98 ff ff bc 0c 00 00 00 00 00 00  ....l...........
>    backtrace (crc e28c80c4):
>      [<ffffffffba25087f>] kmemleak_alloc+0x4f/0x90
>      [<ffffffffb95ecd42>] kmalloc_trace+0x2d2/0x340
>      [<ffffffffb98a7b3d>] aa_alloc_pdb+0x4d/0x90
>      [<ffffffffb98ab3b8>] unpack_pdb+0x48/0x660
>      [<ffffffffb98ac073>] unpack_profile+0x693/0x1090
>      [<ffffffffb98acf5a>] aa_unpack+0x10a/0x6e0
>      [<ffffffffb98a93e3>] aa_replace_profiles+0xa3/0x1210
>      [<ffffffffb989a183>] policy_update+0x163/0x2a0
>      [<ffffffffb989a381>] profile_replace+0xb1/0x130
>      [<ffffffffb966cb64>] vfs_write+0xd4/0x3d0
>      [<ffffffffb966d05b>] ksys_write+0x6b/0xf0
>      [<ffffffffb966d10e>] __x64_sys_write+0x1e/0x30
>      [<ffffffffba242316>] do_syscall_64+0x76/0x120
>      [<ffffffffba4000e5>] entry_SYSCALL_64_after_hwframe+0x6c/0x74
> 
> So add aa_put_pdb(rules->file) to fix it when rules->file is reassigned.
> 
> Fixes: 98b824ff8984 ("apparmor: refcount the pdb")
> Signed-off-by: Gaosheng Cui <cuigaosheng1 at huawei.com>

yep, thanks. I have pulled this into the apparmor tree

Acked-by: John Johansen <john.johansen at canonical.com>

> ---
>   security/apparmor/policy_unpack.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
> index 47ec097d6741..16afe992a724 100644
> --- a/security/apparmor/policy_unpack.c
> +++ b/security/apparmor/policy_unpack.c
> @@ -1022,8 +1022,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
>   		}
>   	} else if (rules->policy->dfa &&
>   		   rules->policy->start[AA_CLASS_FILE]) {
> +		aa_put_pdb(rules->file);
>   		rules->file = aa_get_pdb(rules->policy);
>   	} else {
> +		aa_put_pdb(rules->file);
>   		rules->file = aa_get_pdb(nullpdb);
>   	}
>   	error = -EPROTO;