]> git.proxmox.com Git - mirror_ubuntu-focal-kernel.git/commit
apparmor: Fix memory leak of profile proxy
authorJohn Johansen <john.johansen@canonical.com>
Thu, 19 Aug 2021 13:28:00 +0000 (15:28 +0200)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Mon, 20 Sep 2021 16:50:21 +0000 (18:50 +0200)
commitfb0689b700e8cb3ef4d397d9e00ee8073e3488d3
treec29e4d9b12f18e32d7fb1f0341bfb3ee1c92bd40
parent30f7a33ff67a22ce5da625c0c380382df4bc639f
apparmor: Fix memory leak of profile proxy

BugLink: https://bugs.launchpad.net/bugs/1939915
When the proxy isn't replaced and the profile is removed, the proxy
is being leaked resulting in a kmemleak check message of

unreferenced object 0xffff888077a3a490 (size 16):
  comm "apparmor_parser", pid 128041, jiffies 4322684109 (age 1097.028s)
  hex dump (first 16 bytes):
    03 00 00 00 00 00 00 00 b0 92 fd 4b 81 88 ff ff  ...........K....
  backtrace:
    [<0000000084d5daf2>] aa_alloc_proxy+0x58/0xe0
    [<00000000ecc0e21a>] aa_alloc_profile+0x159/0x1a0
    [<000000004cc9ce15>] unpack_profile+0x275/0x1c40
    [<000000007332b3ca>] aa_unpack+0x1e7/0x7e0
    [<00000000e25e31bd>] aa_replace_profiles+0x18a/0x1d10
    [<00000000350d9415>] policy_update+0x237/0x650
    [<000000003fbf934e>] profile_load+0x122/0x160
    [<0000000047f7b781>] vfs_write+0x139/0x290
    [<000000008ad12358>] ksys_write+0xcd/0x170
    [<000000001a9daa7b>] do_syscall_64+0x70/0x310
    [<00000000b9efb0cf>] entry_SYSCALL_64_after_hwframe+0x49/0xb3

Make sure to cleanup the profile's embedded label which will result
on the proxy being properly freed.

Fixes: 637f688dc3dc ("apparmor: switch from profiles to using labels on contexts")
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 3622ad25d4d68fcbdef3bc084b5916873e785344)
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
security/apparmor/include/label.h
security/apparmor/label.c
security/apparmor/policy.c