* [PATCH] apparmor: fix reference count leak in aa_pivotroot()
@ 2022-04-28 3:39 Xin Xiong
2022-05-19 8:58 ` John Johansen
0 siblings, 1 reply; 2+ messages in thread
From: Xin Xiong @ 2022-04-28 3:39 UTC (permalink / raw)
To: John Johansen, James Morris, Serge E. Hallyn, Seth Arnold,
linux-security-module, linux-kernel
Cc: yuanxzhang, Xin Xiong, Xiyu Yang, Xin Tan
The aa_pivotroot() function has a reference counting bug in a specific
path. When aa_replace_current_label() returns on success, the function
forgets to decrement the reference count of “target”, which is
increased earlier by build_pivotroot(), causing a reference leak.
Fix it by decreasing the refcount of “target” in that path.
Fixes: 2ea3ffb7782a ("apparmor: add mount mediation")
Co-developed-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Co-developed-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
---
security/apparmor/mount.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c
index aa6fcfde3051..d0b19ab9137d 100644
--- a/security/apparmor/mount.c
+++ b/security/apparmor/mount.c
@@ -718,6 +718,7 @@ int aa_pivotroot(struct aa_label *label, const struct path *old_path,
aa_put_label(target);
goto out;
}
+ aa_put_label(target);
} else
/* already audited error */
error = PTR_ERR(target);
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] apparmor: fix reference count leak in aa_pivotroot()
2022-04-28 3:39 [PATCH] apparmor: fix reference count leak in aa_pivotroot() Xin Xiong
@ 2022-05-19 8:58 ` John Johansen
0 siblings, 0 replies; 2+ messages in thread
From: John Johansen @ 2022-05-19 8:58 UTC (permalink / raw)
To: Xin Xiong, James Morris, Serge E. Hallyn, Seth Arnold,
linux-security-module, linux-kernel
Cc: yuanxzhang, Xiyu Yang, Xin Tan
On 4/27/22 20:39, Xin Xiong wrote:
> The aa_pivotroot() function has a reference counting bug in a specific
> path. When aa_replace_current_label() returns on success, the function
> forgets to decrement the reference count of “target”, which is
> increased earlier by build_pivotroot(), causing a reference leak.
>
> Fix it by decreasing the refcount of “target” in that path.
>
> Fixes: 2ea3ffb7782a ("apparmor: add mount mediation")
> Co-developed-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
> Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
> Co-developed-by: Xin Tan <tanxin.ctf@gmail.com>
> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
> Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
thanks I have pulled it into my tree
Acked-by: John Johansen <john.johansen@canonical.com>
> ---
> security/apparmor/mount.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c
> index aa6fcfde3051..d0b19ab9137d 100644
> --- a/security/apparmor/mount.c
> +++ b/security/apparmor/mount.c
> @@ -718,6 +718,7 @@ int aa_pivotroot(struct aa_label *label, const struct path *old_path,
> aa_put_label(target);
> goto out;
> }
> + aa_put_label(target);
> } else
> /* already audited error */
> error = PTR_ERR(target);
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-05-19 8:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-04-28 3:39 [PATCH] apparmor: fix reference count leak in aa_pivotroot() Xin Xiong
2022-05-19 8:58 ` John Johansen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).