[PATCH] apparmor: avoid potential double free when remapping DFA tables

[sashiko-bot at kernel.org]

> From: Li RongQing <lirongqing at baidu.com>
> 
> When unpacking a DFA, aadfaunpack() stores a table in dfa->tables
> before attempting to remap a 16-bit table to 32-bit.
> 
> However, remapdata16todata32() frees the original table when
> allocation of the new table fails. This leaves the corresponding
> dfa->tables entry pointing to freed memory. If the unpacking then
> fails, dfafree() attempts to free the same table again.
> 
> Only publish the table to dfa->tables after any required remapping
> has completed successfully, so that dfa->tables never contains a
> pointer to a table that has already been freed.
> 
> Fixes: 9208c05f9fdf ("apparmor: add support for 2^24 states to the dfa state machine.")
> Signed-off-by: Li RongQing <lirongqing at baidu.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008031533.2205-1-lirongqing@baidu.com?part=1