apparmor: fix memory leak when deduping profile load

3ddae987 · John Johansen <[email protected]> · 2018-04-13 22:33:10 -07:00

AppArmor is leaking the newly loaded profile and its proxy when
the profile is an exact match to the currently loaded version.

In this case the dedup check results in the profile being skipped and
put without dealing with the proxy ref thus not breaking a circular
refcount and causing a leak.

BugLink: http://bugs.launchpad.net/bugs/1750594
Fixes: 5d5182cae401 ("apparmor: move to per loaddata files, instead of replicating in profiles")
Signed-off-by: John Johansen <[email protected]>

Commit: 3ddae9876a7045a8d08ab372eff232a5da5199b8
Parents: 11c92f14

Changes

1 files changed · +3 −0

File	Status	Add	Del	Content
security/apparmor/policy.c	modified	+3	−0	View file

security/apparmor/policy.c

View file

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index b367fef..1590e2d 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -1008,6 +1008,9 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
 			audit_policy(label, op, ns_name, ent->new->base.hname,
 				     "same as current profile, skipping",
 				     error);
+			/* break refcount cycle with proxy. */
+			aa_put_proxy(ent->new->label.proxy);
+			ent->new->label.proxy = NULL;
 			goto skip;
 		}
 