davidlt/kernel-ark
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

apparmor: fix bind mounts aborting with -ENOMEM

Browse Source 
With commit df323337e5 ("apparmor: Use a memory pool instead per-CPU
caches, 2019-05-03"), AppArmor code was converted to use memory pools. In
that conversion, a bug snuck into the code that polices bind mounts that
causes all bind mounts to fail with -ENOMEM, as we erroneously error out
if `aa_get_buffer` returns a pointer instead of erroring out when it
does _not_ return a valid pointer.

Fix the issue by correctly checking for valid pointers returned by
`aa_get_buffer` to fix bind mounts with AppArmor.

Fixes: df323337e5 ("apparmor: Use a memory pool instead per-CPU caches")
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Patrick Steinhardt 2019-12-11 12:44:08 +01:00 committed by John Johansen
parent fd6988496e
commit 9c95a278ba
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
security/apparmor/mount.c
View File

@ -442,7 +442,7 @@ int aa_bind_mount(struct aa_label *label, const struct path *path,
buffer = aa_get_buffer(false); buffer = aa_get_buffer(false);
old_buffer = aa_get_buffer(false); old_buffer = aa_get_buffer(false);
error = -ENOMEM; error = -ENOMEM;
if (!buffer || old_buffer) if (!buffer || !old_buffer)
goto out; goto out;
error = fn_for_each_confined(label, profile, error = fn_for_each_confined(label, profile,