security/apparmor/policy_unpack.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * AppArmor security module
   4  *
   5  * This file contains AppArmor functions for unpacking policy loaded from
   6  * userspace.
   7  *
   8  * Copyright (C) 1998-2008 Novell/SUSE
   9  * Copyright 2009-2010 Canonical Ltd.
  10  *
  11  * AppArmor uses a serialized binary format for loading policy. To find
  12  * policy format documentation see Documentation/admin-guide/LSM/apparmor.rst
  13  * All policy is validated before it is used.
  14  */
  15
  16 #include <asm/unaligned.h>
  17 #include <kunit/visibility.h>
  18 #include <linux/ctype.h>
  19 #include <linux/errno.h>
  20 #include <linux/zstd.h>
  21
  22 #include "include/apparmor.h"
  23 #include "include/audit.h"
  24 #include "include/cred.h"
  25 #include "include/crypto.h"
  26 #include "include/file.h"
  27 #include "include/match.h"
  28 #include "include/path.h"
  29 #include "include/policy.h"
  30 #include "include/policy_unpack.h"
  31 #include "include/policy_compat.h"
  32
  33 /* audit callback for unpack fields */
  34 static void audit_cb(struct audit_buffer *ab, void *va)
  35 {
  36         struct common_audit_data *sa = va;
  37
  38         if (aad(sa)->iface.ns) {
  39                 audit_log_format(ab, " ns=");
  40                 audit_log_untrustedstring(ab, aad(sa)->iface.ns);
  41         }
  42         if (aad(sa)->name) {
  43                 audit_log_format(ab, " name=");
  44                 audit_log_untrustedstring(ab, aad(sa)->name);
  45         }
  46         if (aad(sa)->iface.pos)
  47                 audit_log_format(ab, " offset=%ld", aad(sa)->iface.pos);
  48 }
  49
  50 /**
  51  * audit_iface - do audit message for policy unpacking/load/replace/remove
  52  * @new: profile if it has been allocated (MAYBE NULL)
  53  * @ns_name: name of the ns the profile is to be loaded to (MAY BE NULL)
  54  * @name: name of the profile being manipulated (MAYBE NULL)
  55  * @info: any extra info about the failure (MAYBE NULL)
  56  * @e: buffer position info
  57  * @error: error code
  58  *
  59  * Returns: %0 or error
  60  */
  61 static int audit_iface(struct aa_profile *new, const char *ns_name,
  62                        const char *name, const char *info, struct aa_ext *e,
  63                        int error)
  64 {
  65         struct aa_profile *profile = labels_profile(aa_current_raw_label());
  66         DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, AA_CLASS_NONE, NULL);
  67         if (e)
  68                 aad(&sa)->iface.pos = e->pos - e->start;
  69         aad(&sa)->iface.ns = ns_name;
  70         if (new)
  71                 aad(&sa)->name = new->base.hname;
  72         else
  73                 aad(&sa)->name = name;
  74         aad(&sa)->info = info;
  75         aad(&sa)->error = error;
  76
  77         return aa_audit(AUDIT_APPARMOR_STATUS, profile, &sa, audit_cb);
  78 }
  79
  80 void __aa_loaddata_update(struct aa_loaddata *data, long revision)
  81 {
  82         AA_BUG(!data);
  83         AA_BUG(!data->ns);
  84         AA_BUG(!mutex_is_locked(&data->ns->lock));
  85         AA_BUG(data->revision > revision);
  86
  87         data->revision = revision;
  88         if ((data->dents[AAFS_LOADDATA_REVISION])) {
  89                 d_inode(data->dents[AAFS_LOADDATA_DIR])->i_mtime =
  90                         current_time(d_inode(data->dents[AAFS_LOADDATA_DIR]));
  91                 d_inode(data->dents[AAFS_LOADDATA_REVISION])->i_mtime =
  92                         current_time(d_inode(data->dents[AAFS_LOADDATA_REVISION]));
  93         }
  94 }
  95
  96 bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r)
  97 {
  98         if (l->size != r->size)
  99                 return false;
 100         if (l->compressed_size != r->compressed_size)
 101                 return false;
 102         if (aa_g_hash_policy && memcmp(l->hash, r->hash, aa_hash_size()) != 0)
 103                 return false;
 104         return memcmp(l->data, r->data, r->compressed_size ?: r->size) == 0;
 105 }
 106
 107 /*
 108  * need to take the ns mutex lock which is NOT safe most places that
 109  * put_loaddata is called, so we have to delay freeing it
 110  */
 111 static void do_loaddata_free(struct work_struct *work)
 112 {
 113         struct aa_loaddata *d = container_of(work, struct aa_loaddata, work);
 114         struct aa_ns *ns = aa_get_ns(d->ns);
 115
 116         if (ns) {
 117                 mutex_lock_nested(&ns->lock, ns->level);
 118                 __aa_fs_remove_rawdata(d);
 119                 mutex_unlock(&ns->lock);
 120                 aa_put_ns(ns);
 121         }
 122
 123         kfree_sensitive(d->hash);
 124         kfree_sensitive(d->name);
 125         kvfree(d->data);
 126         kfree_sensitive(d);
 127 }
 128
 129 void aa_loaddata_kref(struct kref *kref)
 130 {
 131         struct aa_loaddata *d = container_of(kref, struct aa_loaddata, count);
 132
 133         if (d) {
 134                 INIT_WORK(&d->work, do_loaddata_free);
 135                 schedule_work(&d->work);
 136         }
 137 }
 138
 139 struct aa_loaddata *aa_loaddata_alloc(size_t size)
 140 {
 141         struct aa_loaddata *d;
 142
 143         d = kzalloc(sizeof(*d), GFP_KERNEL);
 144         if (d == NULL)
 145                 return ERR_PTR(-ENOMEM);
 146         d->data = kvzalloc(size, GFP_KERNEL);
 147         if (!d->data) {
 148                 kfree(d);
 149                 return ERR_PTR(-ENOMEM);
 150         }
 151         kref_init(&d->count);
 152         INIT_LIST_HEAD(&d->list);
 153
 154         return d;
 155 }
 156
 157 /* test if read will be in packed data bounds */
 158 VISIBLE_IF_KUNIT bool aa_inbounds(struct aa_ext *e, size_t size)
 159 {
 160         return (size <= e->end - e->pos);
 161 }
 162 EXPORT_SYMBOL_IF_KUNIT(aa_inbounds);
 163
 164 /**
 165  * aa_unpack_u16_chunk - test and do bounds checking for a u16 size based chunk
 166  * @e: serialized data read head (NOT NULL)
 167  * @chunk: start address for chunk of data (NOT NULL)
 168  *
 169  * Returns: the size of chunk found with the read head at the end of the chunk.
 170  */
 171 VISIBLE_IF_KUNIT size_t aa_unpack_u16_chunk(struct aa_ext *e, char **chunk)
 172 {
 173         size_t size = 0;
 174         void *pos = e->pos;
 175
 176         if (!aa_inbounds(e, sizeof(u16)))
 177                 goto fail;
 178         size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
 179         e->pos += sizeof(__le16);
 180         if (!aa_inbounds(e, size))
 181                 goto fail;
 182         *chunk = e->pos;
 183         e->pos += size;
 184         return size;
 185
 186 fail:
 187         e->pos = pos;
 188         return 0;
 189 }
 190 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u16_chunk);
 191
 192 /* unpack control byte */
 193 VISIBLE_IF_KUNIT bool aa_unpack_X(struct aa_ext *e, enum aa_code code)
 194 {
 195         if (!aa_inbounds(e, 1))
 196                 return false;
 197         if (*(u8 *) e->pos != code)
 198                 return false;
 199         e->pos++;
 200         return true;
 201 }
 202 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_X);
 203
 204 /**
 205  * aa_unpack_nameX - check is the next element is of type X with a name of @name
 206  * @e: serialized data extent information  (NOT NULL)
 207  * @code: type code
 208  * @name: name to match to the serialized element.  (MAYBE NULL)
 209  *
 210  * check that the next serialized data element is of type X and has a tag
 211  * name @name.  If @name is specified then there must be a matching
 212  * name element in the stream.  If @name is NULL any name element will be
 213  * skipped and only the typecode will be tested.
 214  *
 215  * Returns true on success (both type code and name tests match) and the read
 216  * head is advanced past the headers
 217  *
 218  * Returns: false if either match fails, the read head does not move
 219  */
 220 VISIBLE_IF_KUNIT bool aa_unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
 221 {
 222         /*
 223          * May need to reset pos if name or type doesn't match
 224          */
 225         void *pos = e->pos;
 226         /*
 227          * Check for presence of a tagname, and if present name size
 228          * AA_NAME tag value is a u16.
 229          */
 230         if (aa_unpack_X(e, AA_NAME)) {
 231                 char *tag = NULL;
 232                 size_t size = aa_unpack_u16_chunk(e, &tag);
 233                 /* if a name is specified it must match. otherwise skip tag */
 234                 if (name && (!size || tag[size-1] != '\0' || strcmp(name, tag)))
 235                         goto fail;
 236         } else if (name) {
 237                 /* if a name is specified and there is no name tag fail */
 238                 goto fail;
 239         }
 240
 241         /* now check if type code matches */
 242         if (aa_unpack_X(e, code))
 243                 return true;
 244
 245 fail:
 246         e->pos = pos;
 247         return false;
 248 }
 249 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_nameX);
 250
 251 static bool unpack_u8(struct aa_ext *e, u8 *data, const char *name)
 252 {
 253         void *pos = e->pos;
 254
 255         if (aa_unpack_nameX(e, AA_U8, name)) {
 256                 if (!aa_inbounds(e, sizeof(u8)))
 257                         goto fail;
 258                 if (data)
 259                         *data = *((u8 *)e->pos);
 260                 e->pos += sizeof(u8);
 261                 return true;
 262         }
 263
 264 fail:
 265         e->pos = pos;
 266         return false;
 267 }
 268
 269 VISIBLE_IF_KUNIT bool aa_unpack_u32(struct aa_ext *e, u32 *data, const char *name)
 270 {
 271         void *pos = e->pos;
 272
 273         if (aa_unpack_nameX(e, AA_U32, name)) {
 274                 if (!aa_inbounds(e, sizeof(u32)))
 275                         goto fail;
 276                 if (data)
 277                         *data = le32_to_cpu(get_unaligned((__le32 *) e->pos));
 278                 e->pos += sizeof(u32);
 279                 return true;
 280         }
 281
 282 fail:
 283         e->pos = pos;
 284         return false;
 285 }
 286 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u32);
 287
 288 VISIBLE_IF_KUNIT bool aa_unpack_u64(struct aa_ext *e, u64 *data, const char *name)
 289 {
 290         void *pos = e->pos;
 291
 292         if (aa_unpack_nameX(e, AA_U64, name)) {
 293                 if (!aa_inbounds(e, sizeof(u64)))
 294                         goto fail;
 295                 if (data)
 296                         *data = le64_to_cpu(get_unaligned((__le64 *) e->pos));
 297                 e->pos += sizeof(u64);
 298                 return true;
 299         }
 300
 301 fail:
 302         e->pos = pos;
 303         return false;
 304 }
 305 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u64);
 306
 307 static bool aa_unpack_cap_low(struct aa_ext *e, kernel_cap_t *data, const char *name)
 308 {
 309         u32 val;
 310
 311         if (!aa_unpack_u32(e, &val, name))
 312                 return false;
 313         data->val = val;
 314         return true;
 315 }
 316
 317 static bool aa_unpack_cap_high(struct aa_ext *e, kernel_cap_t *data, const char *name)
 318 {
 319         u32 val;
 320
 321         if (!aa_unpack_u32(e, &val, name))
 322                 return false;
 323         data->val = (u32)data->val | ((u64)val << 32);
 324         return true;
 325 }
 326
 327 VISIBLE_IF_KUNIT bool aa_unpack_array(struct aa_ext *e, const char *name, u16 *size)
 328 {
 329         void *pos = e->pos;
 330
 331         if (aa_unpack_nameX(e, AA_ARRAY, name)) {
 332                 if (!aa_inbounds(e, sizeof(u16)))
 333                         goto fail;
 334                 *size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
 335                 e->pos += sizeof(u16);
 336                 return true;
 337         }
 338
 339 fail:
 340         e->pos = pos;
 341         return false;
 342 }
 343 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_array);
 344
 345 VISIBLE_IF_KUNIT size_t aa_unpack_blob(struct aa_ext *e, char **blob, const char *name)
 346 {
 347         void *pos = e->pos;
 348
 349         if (aa_unpack_nameX(e, AA_BLOB, name)) {
 350                 u32 size;
 351                 if (!aa_inbounds(e, sizeof(u32)))
 352                         goto fail;
 353                 size = le32_to_cpu(get_unaligned((__le32 *) e->pos));
 354                 e->pos += sizeof(u32);
 355                 if (aa_inbounds(e, (size_t) size)) {
 356                         *blob = e->pos;
 357                         e->pos += size;
 358                         return size;
 359                 }
 360         }
 361
 362 fail:
 363         e->pos = pos;
 364         return 0;
 365 }
 366 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_blob);
 367
 368 VISIBLE_IF_KUNIT int aa_unpack_str(struct aa_ext *e, const char **string, const char *name)
 369 {
 370         char *src_str;
 371         size_t size = 0;
 372         void *pos = e->pos;
 373         *string = NULL;
 374         if (aa_unpack_nameX(e, AA_STRING, name)) {
 375                 size = aa_unpack_u16_chunk(e, &src_str);
 376                 if (size) {
 377                         /* strings are null terminated, length is size - 1 */
 378                         if (src_str[size - 1] != 0)
 379                                 goto fail;
 380                         *string = src_str;
 381
 382                         return size;
 383                 }
 384         }
 385
 386 fail:
 387         e->pos = pos;
 388         return 0;
 389 }
 390 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_str);
 391
 392 VISIBLE_IF_KUNIT int aa_unpack_strdup(struct aa_ext *e, char **string, const char *name)
 393 {
 394         const char *tmp;
 395         void *pos = e->pos;
 396         int res = aa_unpack_str(e, &tmp, name);
 397         *string = NULL;
 398
 399         if (!res)
 400                 return 0;
 401
 402         *string = kmemdup(tmp, res, GFP_KERNEL);
 403         if (!*string) {
 404                 e->pos = pos;
 405                 return 0;
 406         }
 407
 408         return res;
 409 }
 410 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_strdup);
 411
 412
 413 /**
 414  * unpack_dfa - unpack a file rule dfa
 415  * @e: serialized data extent information (NOT NULL)
 416  * @flags: dfa flags to check
 417  *
 418  * returns dfa or ERR_PTR or NULL if no dfa
 419  */
 420 static struct aa_dfa *unpack_dfa(struct aa_ext *e, int flags)
 421 {
 422         char *blob = NULL;
 423         size_t size;
 424         struct aa_dfa *dfa = NULL;
 425
 426         size = aa_unpack_blob(e, &blob, "aadfa");
 427         if (size) {
 428                 /*
 429                  * The dfa is aligned with in the blob to 8 bytes
 430                  * from the beginning of the stream.
 431                  * alignment adjust needed by dfa unpack
 432                  */
 433                 size_t sz = blob - (char *) e->start -
 434                         ((e->pos - e->start) & 7);
 435                 size_t pad = ALIGN(sz, 8) - sz;
 436                 if (aa_g_paranoid_load)
 437                         flags |= DFA_FLAG_VERIFY_STATES;
 438                 dfa = aa_dfa_unpack(blob + pad, size - pad, flags);
 439
 440                 if (IS_ERR(dfa))
 441                         return dfa;
 442
 443         }
 444
 445         return dfa;
 446 }
 447
 448 /**
 449  * unpack_trans_table - unpack a profile transition table
 450  * @e: serialized data extent information  (NOT NULL)
 451  * @strs: str table to unpack to (NOT NULL)
 452  *
 453  * Returns: true if table successfully unpacked or not present
 454  */
 455 static bool unpack_trans_table(struct aa_ext *e, struct aa_str_table *strs)
 456 {
 457         void *saved_pos = e->pos;
 458         char **table = NULL;
 459
 460         /* exec table is optional */
 461         if (aa_unpack_nameX(e, AA_STRUCT, "xtable")) {
 462                 u16 size;
 463                 int i;
 464
 465                 if (!aa_unpack_array(e, NULL, &size))
 466                         /*
 467                          * Note: index into trans table array is a max
 468                          * of 2^24, but unpack array can only unpack
 469                          * an array of 2^16 in size atm so no need
 470                          * for size check here
 471                          */
 472                         goto fail;
 473                 table = kcalloc(size, sizeof(char *), GFP_KERNEL);
 474                 if (!table)
 475                         goto fail;
 476
 477                 for (i = 0; i < size; i++) {
 478                         char *str;
 479                         int c, j, pos, size2 = aa_unpack_strdup(e, &str, NULL);
 480                         /* aa_unpack_strdup verifies that the last character is
 481                          * null termination byte.
 482                          */
 483                         if (!size2)
 484                                 goto fail;
 485                         table[i] = str;
 486                         /* verify that name doesn't start with space */
 487                         if (isspace(*str))
 488                                 goto fail;
 489
 490                         /* count internal #  of internal \0 */
 491                         for (c = j = 0; j < size2 - 1; j++) {
 492                                 if (!str[j]) {
 493                                         pos = j;
 494                                         c++;
 495                                 }
 496                         }
 497                         if (*str == ':') {
 498                                 /* first character after : must be valid */
 499                                 if (!str[1])
 500                                         goto fail;
 501                                 /* beginning with : requires an embedded \0,
 502                                  * verify that exactly 1 internal \0 exists
 503                                  * trailing \0 already verified by aa_unpack_strdup
 504                                  *
 505                                  * convert \0 back to : for label_parse
 506                                  */
 507                                 if (c == 1)
 508                                         str[pos] = ':';
 509                                 else if (c > 1)
 510                                         goto fail;
 511                         } else if (c)
 512                                 /* fail - all other cases with embedded \0 */
 513                                 goto fail;
 514                 }
 515                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 516                         goto fail;
 517                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 518                         goto fail;
 519
 520                 strs->table = table;
 521                 strs->size = size;
 522         }
 523         return true;
 524
 525 fail:
 526         kfree_sensitive(table);
 527         e->pos = saved_pos;
 528         return false;
 529 }
 530
 531 static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)
 532 {
 533         void *pos = e->pos;
 534
 535         if (aa_unpack_nameX(e, AA_STRUCT, "xattrs")) {
 536                 u16 size;
 537                 int i;
 538
 539                 if (!aa_unpack_array(e, NULL, &size))
 540                         goto fail;
 541                 profile->attach.xattr_count = size;
 542                 profile->attach.xattrs = kcalloc(size, sizeof(char *), GFP_KERNEL);
 543                 if (!profile->attach.xattrs)
 544                         goto fail;
 545                 for (i = 0; i < size; i++) {
 546                         if (!aa_unpack_strdup(e, &profile->attach.xattrs[i], NULL))
 547                                 goto fail;
 548                 }
 549                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 550                         goto fail;
 551                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 552                         goto fail;
 553         }
 554
 555         return true;
 556
 557 fail:
 558         e->pos = pos;
 559         return false;
 560 }
 561
 562 static bool unpack_secmark(struct aa_ext *e, struct aa_ruleset *rules)
 563 {
 564         void *pos = e->pos;
 565         u16 size;
 566         int i;
 567
 568         if (aa_unpack_nameX(e, AA_STRUCT, "secmark")) {
 569                 if (!aa_unpack_array(e, NULL, &size))
 570                         goto fail;
 571
 572                 rules->secmark = kcalloc(size, sizeof(struct aa_secmark),
 573                                            GFP_KERNEL);
 574                 if (!rules->secmark)
 575                         goto fail;
 576
 577                 rules->secmark_count = size;
 578
 579                 for (i = 0; i < size; i++) {
 580                         if (!unpack_u8(e, &rules->secmark[i].audit, NULL))
 581                                 goto fail;
 582                         if (!unpack_u8(e, &rules->secmark[i].deny, NULL))
 583                                 goto fail;
 584                         if (!aa_unpack_strdup(e, &rules->secmark[i].label, NULL))
 585                                 goto fail;
 586                 }
 587                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 588                         goto fail;
 589                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 590                         goto fail;
 591         }
 592
 593         return true;
 594
 595 fail:
 596         if (rules->secmark) {
 597                 for (i = 0; i < size; i++)
 598                         kfree(rules->secmark[i].label);
 599                 kfree(rules->secmark);
 600                 rules->secmark_count = 0;
 601                 rules->secmark = NULL;
 602         }
 603
 604         e->pos = pos;
 605         return false;
 606 }
 607
 608 static bool unpack_rlimits(struct aa_ext *e, struct aa_ruleset *rules)
 609 {
 610         void *pos = e->pos;
 611
 612         /* rlimits are optional */
 613         if (aa_unpack_nameX(e, AA_STRUCT, "rlimits")) {
 614                 u16 size;
 615                 int i;
 616                 u32 tmp = 0;
 617                 if (!aa_unpack_u32(e, &tmp, NULL))
 618                         goto fail;
 619                 rules->rlimits.mask = tmp;
 620
 621                 if (!aa_unpack_array(e, NULL, &size) ||
 622                     size > RLIM_NLIMITS)
 623                         goto fail;
 624                 for (i = 0; i < size; i++) {
 625                         u64 tmp2 = 0;
 626                         int a = aa_map_resource(i);
 627                         if (!aa_unpack_u64(e, &tmp2, NULL))
 628                                 goto fail;
 629                         rules->rlimits.limits[a].rlim_max = tmp2;
 630                 }
 631                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 632                         goto fail;
 633                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 634                         goto fail;
 635         }
 636         return true;
 637
 638 fail:
 639         e->pos = pos;
 640         return false;
 641 }
 642
 643 static bool unpack_perm(struct aa_ext *e, u32 version, struct aa_perms *perm)
 644 {
 645         if (version != 1)
 646                 return false;
 647
 648         return  aa_unpack_u32(e, &perm->allow, NULL) &&
 649                 aa_unpack_u32(e, &perm->allow, NULL) &&
 650                 aa_unpack_u32(e, &perm->deny, NULL) &&
 651                 aa_unpack_u32(e, &perm->subtree, NULL) &&
 652                 aa_unpack_u32(e, &perm->cond, NULL) &&
 653                 aa_unpack_u32(e, &perm->kill, NULL) &&
 654                 aa_unpack_u32(e, &perm->complain, NULL) &&
 655                 aa_unpack_u32(e, &perm->prompt, NULL) &&
 656                 aa_unpack_u32(e, &perm->audit, NULL) &&
 657                 aa_unpack_u32(e, &perm->quiet, NULL) &&
 658                 aa_unpack_u32(e, &perm->hide, NULL) &&
 659                 aa_unpack_u32(e, &perm->xindex, NULL) &&
 660                 aa_unpack_u32(e, &perm->tag, NULL) &&
 661                 aa_unpack_u32(e, &perm->label, NULL);
 662 }
 663
 664 static ssize_t unpack_perms_table(struct aa_ext *e, struct aa_perms **perms)
 665 {
 666         void *pos = e->pos;
 667         u16 size = 0;
 668
 669         AA_BUG(!perms);
 670         /*
 671          * policy perms are optional, in which case perms are embedded
 672          * in the dfa accept table
 673          */
 674         if (aa_unpack_nameX(e, AA_STRUCT, "perms")) {
 675                 int i;
 676                 u32 version;
 677
 678                 if (!aa_unpack_u32(e, &version, "version"))
 679                         goto fail_reset;
 680                 if (!aa_unpack_array(e, NULL, &size))
 681                         goto fail_reset;
 682                 *perms = kcalloc(size, sizeof(struct aa_perms), GFP_KERNEL);
 683                 if (!*perms)
 684                         goto fail_reset;
 685                 for (i = 0; i < size; i++) {
 686                         if (!unpack_perm(e, version, &(*perms)[i]))
 687                                 goto fail;
 688                 }
 689                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 690                         goto fail;
 691                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 692                         goto fail;
 693         } else
 694                 *perms = NULL;
 695
 696         return size;
 697
 698 fail:
 699         kfree(*perms);
 700 fail_reset:
 701         e->pos = pos;
 702         return -EPROTO;
 703 }
 704
 705 static int unpack_pdb(struct aa_ext *e, struct aa_policydb *policy,
 706                       bool required_dfa, bool required_trans,
 707                       const char **info)
 708 {
 709         void *pos = e->pos;
 710         int i, flags, error = -EPROTO;
 711         ssize_t size;
 712
 713         size = unpack_perms_table(e, &policy->perms);
 714         if (size < 0) {
 715                 error = size;
 716                 policy->perms = NULL;
 717                 *info = "failed to unpack - perms";
 718                 goto fail;
 719         }
 720         policy->size = size;
 721
 722         if (policy->perms) {
 723                 /* perms table present accept is index */
 724                 flags = TO_ACCEPT1_FLAG(YYTD_DATA32);
 725         } else {
 726                 /* packed perms in accept1 and accept2 */
 727                 flags = TO_ACCEPT1_FLAG(YYTD_DATA32) |
 728                         TO_ACCEPT2_FLAG(YYTD_DATA32);
 729         }
 730
 731         policy->dfa = unpack_dfa(e, flags);
 732         if (IS_ERR(policy->dfa)) {
 733                 error = PTR_ERR(policy->dfa);
 734                 policy->dfa = NULL;
 735                 *info = "failed to unpack - dfa";
 736                 goto fail;
 737         } else if (!policy->dfa) {
 738                 if (required_dfa) {
 739                         *info = "missing required dfa";
 740                         goto fail;
 741                 }
 742                 goto out;
 743         }
 744
 745         /*
 746          * only unpack the following if a dfa is present
 747          *
 748          * sadly start was given different names for file and policydb
 749          * but since it is optional we can try both
 750          */
 751         if (!aa_unpack_u32(e, &policy->start[0], "start"))
 752                 /* default start state */
 753                 policy->start[0] = DFA_START;
 754         if (!aa_unpack_u32(e, &policy->start[AA_CLASS_FILE], "dfa_start")) {
 755                 /* default start state for xmatch and file dfa */
 756                 policy->start[AA_CLASS_FILE] = DFA_START;
 757         }       /* setup class index */
 758         for (i = AA_CLASS_FILE + 1; i <= AA_CLASS_LAST; i++) {
 759                 policy->start[i] = aa_dfa_next(policy->dfa, policy->start[0],
 760                                                i);
 761         }
 762         if (!unpack_trans_table(e, &policy->trans) && required_trans) {
 763                 *info = "failed to unpack profile transition table";
 764                 goto fail;
 765         }
 766
 767         /* TODO: move compat mapping here, requires dfa merging first */
 768         /* TODO: move verify here, it has to be done after compat mappings */
 769 out:
 770         return 0;
 771
 772 fail:
 773         e->pos = pos;
 774         return error;
 775 }
 776
 777 static u32 strhash(const void *data, u32 len, u32 seed)
 778 {
 779         const char * const *key = data;
 780
 781         return jhash(*key, strlen(*key), seed);
 782 }
 783
 784 static int datacmp(struct rhashtable_compare_arg *arg, const void *obj)
 785 {
 786         const struct aa_data *data = obj;
 787         const char * const *key = arg->key;
 788
 789         return strcmp(data->key, *key);
 790 }
 791
 792 /**
 793  * unpack_profile - unpack a serialized profile
 794  * @e: serialized data extent information (NOT NULL)
 795  * @ns_name: pointer of newly allocated copy of %NULL in case of error
 796  *
 797  * NOTE: unpack profile sets audit struct if there is a failure
 798  */
 799 static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
 800 {
 801         struct aa_ruleset *rules;
 802         struct aa_profile *profile = NULL;
 803         const char *tmpname, *tmpns = NULL, *name = NULL;
 804         const char *info = "failed to unpack profile";
 805         size_t ns_len;
 806         struct rhashtable_params params = { 0 };
 807         char *key = NULL;
 808         struct aa_data *data;
 809         int error = -EPROTO;
 810         kernel_cap_t tmpcap;
 811         u32 tmp;
 812
 813         *ns_name = NULL;
 814
 815         /* check that we have the right struct being passed */
 816         if (!aa_unpack_nameX(e, AA_STRUCT, "profile"))
 817                 goto fail;
 818         if (!aa_unpack_str(e, &name, NULL))
 819                 goto fail;
 820         if (*name == '\0')
 821                 goto fail;
 822
 823         tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len);
 824         if (tmpns) {
 825                 *ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL);
 826                 if (!*ns_name) {
 827                         info = "out of memory";
 828                         error = -ENOMEM;
 829                         goto fail;
 830                 }
 831                 name = tmpname;
 832         }
 833
 834         profile = aa_alloc_profile(name, NULL, GFP_KERNEL);
 835         if (!profile) {
 836                 info = "out of memory";
 837                 error = -ENOMEM;
 838                 goto fail;
 839         }
 840         rules = list_first_entry(&profile->rules, typeof(*rules), list);
 841
 842         /* profile renaming is optional */
 843         (void) aa_unpack_str(e, &profile->rename, "rename");
 844
 845         /* attachment string is optional */
 846         (void) aa_unpack_str(e, &profile->attach.xmatch_str, "attach");
 847
 848         /* xmatch is optional and may be NULL */
 849         error = unpack_pdb(e, &profile->attach.xmatch, false, false, &info);
 850         if (error) {
 851                 info = "bad xmatch";
 852                 goto fail;
 853         }
 854
 855         /* neither xmatch_len not xmatch_perms are optional if xmatch is set */
 856         if (profile->attach.xmatch.dfa) {
 857                 if (!aa_unpack_u32(e, &tmp, NULL)) {
 858                         info = "missing xmatch len";
 859                         goto fail;
 860                 }
 861                 profile->attach.xmatch_len = tmp;
 862                 profile->attach.xmatch.start[AA_CLASS_XMATCH] = DFA_START;
 863                 if (!profile->attach.xmatch.perms) {
 864                         error = aa_compat_map_xmatch(&profile->attach.xmatch);
 865                         if (error) {
 866                                 info = "failed to convert xmatch permission table";
 867                                 goto fail;
 868                         }
 869                 }
 870         }
 871
 872         /* disconnected attachment string is optional */
 873         (void) aa_unpack_str(e, &profile->disconnected, "disconnected");
 874
 875         /* per profile debug flags (complain, audit) */
 876         if (!aa_unpack_nameX(e, AA_STRUCT, "flags")) {
 877                 info = "profile missing flags";
 878                 goto fail;
 879         }
 880         info = "failed to unpack profile flags";
 881         if (!aa_unpack_u32(e, &tmp, NULL))
 882                 goto fail;
 883         if (tmp & PACKED_FLAG_HAT)
 884                 profile->label.flags |= FLAG_HAT;
 885         if (tmp & PACKED_FLAG_DEBUG1)
 886                 profile->label.flags |= FLAG_DEBUG1;
 887         if (tmp & PACKED_FLAG_DEBUG2)
 888                 profile->label.flags |= FLAG_DEBUG2;
 889         if (!aa_unpack_u32(e, &tmp, NULL))
 890                 goto fail;
 891         if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) {
 892                 profile->mode = APPARMOR_COMPLAIN;
 893         } else if (tmp == PACKED_MODE_ENFORCE) {
 894                 profile->mode = APPARMOR_ENFORCE;
 895         } else if (tmp == PACKED_MODE_KILL) {
 896                 profile->mode = APPARMOR_KILL;
 897         } else if (tmp == PACKED_MODE_UNCONFINED) {
 898                 profile->mode = APPARMOR_UNCONFINED;
 899                 profile->label.flags |= FLAG_UNCONFINED;
 900         } else if (tmp == PACKED_MODE_USER) {
 901                 profile->mode = APPARMOR_USER;
 902         } else {
 903                 goto fail;
 904         }
 905         if (!aa_unpack_u32(e, &tmp, NULL))
 906                 goto fail;
 907         if (tmp)
 908                 profile->audit = AUDIT_ALL;
 909
 910         if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 911                 goto fail;
 912
 913         /* path_flags is optional */
 914         if (aa_unpack_u32(e, &profile->path_flags, "path_flags"))
 915                 profile->path_flags |= profile->label.flags &
 916                         PATH_MEDIATE_DELETED;
 917         else
 918                 /* set a default value if path_flags field is not present */
 919                 profile->path_flags = PATH_MEDIATE_DELETED;
 920
 921         info = "failed to unpack profile capabilities";
 922         if (!aa_unpack_cap_low(e, &rules->caps.allow, NULL))
 923                 goto fail;
 924         if (!aa_unpack_cap_low(e, &rules->caps.audit, NULL))
 925                 goto fail;
 926         if (!aa_unpack_cap_low(e, &rules->caps.quiet, NULL))
 927                 goto fail;
 928         if (!aa_unpack_cap_low(e, &tmpcap, NULL))
 929                 goto fail;
 930
 931         info = "failed to unpack upper profile capabilities";
 932         if (aa_unpack_nameX(e, AA_STRUCT, "caps64")) {
 933                 /* optional upper half of 64 bit caps */
 934                 if (!aa_unpack_cap_high(e, &rules->caps.allow, NULL))
 935                         goto fail;
 936                 if (!aa_unpack_cap_high(e, &rules->caps.audit, NULL))
 937                         goto fail;
 938                 if (!aa_unpack_cap_high(e, &rules->caps.quiet, NULL))
 939                         goto fail;
 940                 if (!aa_unpack_cap_high(e, &tmpcap, NULL))
 941                         goto fail;
 942                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 943                         goto fail;
 944         }
 945
 946         info = "failed to unpack extended profile capabilities";
 947         if (aa_unpack_nameX(e, AA_STRUCT, "capsx")) {
 948                 /* optional extended caps mediation mask */
 949                 if (!aa_unpack_cap_low(e, &rules->caps.extended, NULL))
 950                         goto fail;
 951                 if (!aa_unpack_cap_high(e, &rules->caps.extended, NULL))
 952                         goto fail;
 953                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 954                         goto fail;
 955         }
 956
 957         if (!unpack_xattrs(e, profile)) {
 958                 info = "failed to unpack profile xattrs";
 959                 goto fail;
 960         }
 961
 962         if (!unpack_rlimits(e, rules)) {
 963                 info = "failed to unpack profile rlimits";
 964                 goto fail;
 965         }
 966
 967         if (!unpack_secmark(e, rules)) {
 968                 info = "failed to unpack profile secmark rules";
 969                 goto fail;
 970         }
 971
 972         if (aa_unpack_nameX(e, AA_STRUCT, "policydb")) {
 973                 /* generic policy dfa - optional and may be NULL */
 974                 info = "failed to unpack policydb";
 975                 error = unpack_pdb(e, &rules->policy, true, false,
 976                                    &info);
 977                 if (error)
 978                         goto fail;
 979                 /* Fixup: drop when we get rid of start array */
 980                 if (aa_dfa_next(rules->policy.dfa, rules->policy.start[0],
 981                                 AA_CLASS_FILE))
 982                         rules->policy.start[AA_CLASS_FILE] =
 983                           aa_dfa_next(rules->policy.dfa,
 984                                       rules->policy.start[0],
 985                                       AA_CLASS_FILE);
 986                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 987                         goto fail;
 988                 if (!rules->policy.perms) {
 989                         error = aa_compat_map_policy(&rules->policy,
 990                                                      e->version);
 991                         if (error) {
 992                                 info = "failed to remap policydb permission table";
 993                                 goto fail;
 994                         }
 995                 }
 996         } else {
 997                 rules->policy.dfa = aa_get_dfa(nulldfa);
 998                 rules->policy.perms = kcalloc(2, sizeof(struct aa_perms),
 999                                               GFP_KERNEL);
1000                 if (!rules->policy.perms)
1001                         goto fail;
1002                 rules->policy.size = 2;
1003         }
1004         /* get file rules */
1005         error = unpack_pdb(e, &rules->file, false, true, &info);
1006         if (error) {
1007                 goto fail;
1008         } else if (rules->file.dfa) {
1009                 if (!rules->file.perms) {
1010                         error = aa_compat_map_file(&rules->file);
1011                         if (error) {
1012                                 info = "failed to remap file permission table";
1013                                 goto fail;
1014                         }
1015                 }
1016         } else if (rules->policy.dfa &&
1017                    rules->policy.start[AA_CLASS_FILE]) {
1018                 rules->file.dfa = aa_get_dfa(rules->policy.dfa);
1019                 rules->file.start[AA_CLASS_FILE] = rules->policy.start[AA_CLASS_FILE];
1020                 rules->file.perms = kcalloc(rules->policy.size,
1021                                             sizeof(struct aa_perms),
1022                                             GFP_KERNEL);
1023                 if (!rules->file.perms)
1024                         goto fail;
1025                 memcpy(rules->file.perms, rules->policy.perms,
1026                        rules->policy.size * sizeof(struct aa_perms));
1027                 rules->file.size = rules->policy.size;
1028         } else {
1029                 rules->file.dfa = aa_get_dfa(nulldfa);
1030                 rules->file.perms = kcalloc(2, sizeof(struct aa_perms),
1031                                             GFP_KERNEL);
1032                 if (!rules->file.perms)
1033                         goto fail;
1034                 rules->file.size = 2;
1035         }
1036         error = -EPROTO;
1037         if (aa_unpack_nameX(e, AA_STRUCT, "data")) {
1038                 info = "out of memory";
1039                 profile->data = kzalloc(sizeof(*profile->data), GFP_KERNEL);
1040                 if (!profile->data) {
1041                         error = -ENOMEM;
1042                         goto fail;
1043                 }
1044                 params.nelem_hint = 3;
1045                 params.key_len = sizeof(void *);
1046                 params.key_offset = offsetof(struct aa_data, key);
1047                 params.head_offset = offsetof(struct aa_data, head);
1048                 params.hashfn = strhash;
1049                 params.obj_cmpfn = datacmp;
1050
1051                 if (rhashtable_init(profile->data, &params)) {
1052                         info = "failed to init key, value hash table";
1053                         goto fail;
1054                 }
1055
1056                 while (aa_unpack_strdup(e, &key, NULL)) {
1057                         data = kzalloc(sizeof(*data), GFP_KERNEL);
1058                         if (!data) {
1059                                 kfree_sensitive(key);
1060                                 error = -ENOMEM;
1061                                 goto fail;
1062                         }
1063
1064                         data->key = key;
1065                         data->size = aa_unpack_blob(e, &data->data, NULL);
1066                         data->data = kvmemdup(data->data, data->size, GFP_KERNEL);
1067                         if (data->size && !data->data) {
1068                                 kfree_sensitive(data->key);
1069                                 kfree_sensitive(data);
1070                                 error = -ENOMEM;
1071                                 goto fail;
1072                         }
1073
1074                         if (rhashtable_insert_fast(profile->data, &data->head,
1075                                                    profile->data->p)) {
1076                                 kfree_sensitive(data->key);
1077                                 kfree_sensitive(data);
1078                                 info = "failed to insert data to table";
1079                                 goto fail;
1080                         }
1081                 }
1082
1083                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
1084                         info = "failed to unpack end of key, value data table";
1085                         goto fail;
1086                 }
1087         }
1088
1089         if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
1090                 info = "failed to unpack end of profile";
1091                 goto fail;
1092         }
1093
1094         return profile;
1095
1096 fail:
1097         if (error == 0)
1098                 /* default error covers most cases */
1099                 error = -EPROTO;
1100         if (*ns_name) {
1101                 kfree(*ns_name);
1102                 *ns_name = NULL;
1103         }
1104         if (profile)
1105                 name = NULL;
1106         else if (!name)
1107                 name = "unknown";
1108         audit_iface(profile, NULL, name, info, e, error);
1109         aa_free_profile(profile);
1110
1111         return ERR_PTR(error);
1112 }
1113
1114 /**
1115  * verify_header - unpack serialized stream header
1116  * @e: serialized data read head (NOT NULL)
1117  * @required: whether the header is required or optional
1118  * @ns: Returns - namespace if one is specified else NULL (NOT NULL)
1119  *
1120  * Returns: error or 0 if header is good
1121  */
1122 static int verify_header(struct aa_ext *e, int required, const char **ns)
1123 {
1124         int error = -EPROTONOSUPPORT;
1125         const char *name = NULL;
1126         *ns = NULL;
1127
1128         /* get the interface version */
1129         if (!aa_unpack_u32(e, &e->version, "version")) {
1130                 if (required) {
1131                         audit_iface(NULL, NULL, NULL, "invalid profile format",
1132                                     e, error);
1133                         return error;
1134                 }
1135         }
1136
1137         /* Check that the interface version is currently supported.
1138          * if not specified use previous version
1139          * Mask off everything that is not kernel abi version
1140          */
1141         if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v9)) {
1142                 audit_iface(NULL, NULL, NULL, "unsupported interface version",
1143                             e, error);
1144                 return error;
1145         }
1146
1147         /* read the namespace if present */
1148         if (aa_unpack_str(e, &name, "namespace")) {
1149                 if (*name == '\0') {
1150                         audit_iface(NULL, NULL, NULL, "invalid namespace name",
1151                                     e, error);
1152                         return error;
1153                 }
1154                 if (*ns && strcmp(*ns, name)) {
1155                         audit_iface(NULL, NULL, NULL, "invalid ns change", e,
1156                                     error);
1157                 } else if (!*ns) {
1158                         *ns = kstrdup(name, GFP_KERNEL);
1159                         if (!*ns)
1160                                 return -ENOMEM;
1161                 }
1162         }
1163
1164         return 0;
1165 }
1166
1167 /**
1168  * verify_dfa_accept_index - verify accept indexes are in range of perms table
1169  * @dfa: the dfa to check accept indexes are in range
1170  * table_size: the permission table size the indexes should be within
1171  */
1172 static bool verify_dfa_accept_index(struct aa_dfa *dfa, int table_size)
1173 {
1174         int i;
1175         for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
1176                 if (ACCEPT_TABLE(dfa)[i] >= table_size)
1177                         return false;
1178         }
1179         return true;
1180 }
1181
1182 static bool verify_perm(struct aa_perms *perm)
1183 {
1184         /* TODO: allow option to just force the perms into a valid state */
1185         if (perm->allow & perm->deny)
1186                 return false;
1187         if (perm->subtree & ~perm->allow)
1188                 return false;
1189         if (perm->cond & (perm->allow | perm->deny))
1190                 return false;
1191         if (perm->kill & perm->allow)
1192                 return false;
1193         if (perm->complain & (perm->allow | perm->deny))
1194                 return false;
1195         if (perm->prompt & (perm->allow | perm->deny))
1196                 return false;
1197         if (perm->complain & perm->prompt)
1198                 return false;
1199         if (perm->hide & perm->allow)
1200                 return false;
1201
1202         return true;
1203 }
1204
1205 static bool verify_perms(struct aa_policydb *pdb)
1206 {
1207         int i;
1208
1209         for (i = 0; i < pdb->size; i++) {
1210                 if (!verify_perm(&pdb->perms[i]))
1211                         return false;
1212                 /* verify indexes into str table */
1213                 if ((pdb->perms[i].xindex & AA_X_TYPE_MASK) == AA_X_TABLE &&
1214                     (pdb->perms[i].xindex & AA_X_INDEX_MASK) >= pdb->trans.size)
1215                         return false;
1216                 if (pdb->perms[i].tag && pdb->perms[i].tag >= pdb->trans.size)
1217                         return false;
1218                 if (pdb->perms[i].label &&
1219                     pdb->perms[i].label >= pdb->trans.size)
1220                         return false;
1221         }
1222
1223         return true;
1224 }
1225
1226 /**
1227  * verify_profile - Do post unpack analysis to verify profile consistency
1228  * @profile: profile to verify (NOT NULL)
1229  *
1230  * Returns: 0 if passes verification else error
1231  *
1232  * This verification is post any unpack mapping or changes
1233  */
1234 static int verify_profile(struct aa_profile *profile)
1235 {
1236         struct aa_ruleset *rules = list_first_entry(&profile->rules,
1237                                                     typeof(*rules), list);
1238         if (!rules)
1239                 return 0;
1240
1241         if ((rules->file.dfa && !verify_dfa_accept_index(rules->file.dfa,
1242                                                          rules->file.size)) ||
1243             (rules->policy.dfa &&
1244              !verify_dfa_accept_index(rules->policy.dfa, rules->policy.size))) {
1245                 audit_iface(profile, NULL, NULL,
1246                             "Unpack: Invalid named transition", NULL, -EPROTO);
1247                 return -EPROTO;
1248         }
1249
1250         if (!verify_perms(&rules->file)) {
1251                 audit_iface(profile, NULL, NULL,
1252                             "Unpack: Invalid perm index", NULL, -EPROTO);
1253                 return -EPROTO;
1254         }
1255         if (!verify_perms(&rules->policy)) {
1256                 audit_iface(profile, NULL, NULL,
1257                             "Unpack: Invalid perm index", NULL, -EPROTO);
1258                 return -EPROTO;
1259         }
1260         if (!verify_perms(&profile->attach.xmatch)) {
1261                 audit_iface(profile, NULL, NULL,
1262                             "Unpack: Invalid perm index", NULL, -EPROTO);
1263                 return -EPROTO;
1264         }
1265
1266         return 0;
1267 }
1268
1269 void aa_load_ent_free(struct aa_load_ent *ent)
1270 {
1271         if (ent) {
1272                 aa_put_profile(ent->rename);
1273                 aa_put_profile(ent->old);
1274                 aa_put_profile(ent->new);
1275                 kfree(ent->ns_name);
1276                 kfree_sensitive(ent);
1277         }
1278 }
1279
1280 struct aa_load_ent *aa_load_ent_alloc(void)
1281 {
1282         struct aa_load_ent *ent = kzalloc(sizeof(*ent), GFP_KERNEL);
1283         if (ent)
1284                 INIT_LIST_HEAD(&ent->list);
1285         return ent;
1286 }
1287
1288 static int compress_zstd(const char *src, size_t slen, char **dst, size_t *dlen)
1289 {
1290 #ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
1291         const zstd_parameters params =
1292                 zstd_get_params(aa_g_rawdata_compression_level, slen);
1293         const size_t wksp_len = zstd_cctx_workspace_bound(&params.cParams);
1294         void *wksp = NULL;
1295         zstd_cctx *ctx = NULL;
1296         size_t out_len = zstd_compress_bound(slen);
1297         void *out = NULL;
1298         int ret = 0;
1299
1300         out = kvzalloc(out_len, GFP_KERNEL);
1301         if (!out) {
1302                 ret = -ENOMEM;
1303                 goto cleanup;
1304         }
1305
1306         wksp = kvzalloc(wksp_len, GFP_KERNEL);
1307         if (!wksp) {
1308                 ret = -ENOMEM;
1309                 goto cleanup;
1310         }
1311
1312         ctx = zstd_init_cctx(wksp, wksp_len);
1313         if (!ctx) {
1314                 ret = -EINVAL;
1315                 goto cleanup;
1316         }
1317
1318         out_len = zstd_compress_cctx(ctx, out, out_len, src, slen, &params);
1319         if (zstd_is_error(out_len) || out_len >= slen) {
1320                 ret = -EINVAL;
1321                 goto cleanup;
1322         }
1323
1324         if (is_vmalloc_addr(out)) {
1325                 *dst = kvzalloc(out_len, GFP_KERNEL);
1326                 if (*dst) {
1327                         memcpy(*dst, out, out_len);
1328                         kvfree(out);
1329                         out = NULL;
1330                 }
1331         } else {
1332                 /*
1333                  * If the staging buffer was kmalloc'd, then using krealloc is
1334                  * probably going to be faster. The destination buffer will
1335                  * always be smaller, so it's just shrunk, avoiding a memcpy
1336                  */
1337                 *dst = krealloc(out, out_len, GFP_KERNEL);
1338         }
1339
1340         if (!*dst) {
1341                 ret = -ENOMEM;
1342                 goto cleanup;
1343         }
1344
1345         *dlen = out_len;
1346
1347 cleanup:
1348         if (ret) {
1349                 kvfree(out);
1350                 *dst = NULL;
1351         }
1352
1353         kvfree(wksp);
1354         return ret;
1355 #else
1356         *dlen = slen;
1357         return 0;
1358 #endif
1359 }
1360
1361 static int compress_loaddata(struct aa_loaddata *data)
1362 {
1363         AA_BUG(data->compressed_size > 0);
1364
1365         /*
1366          * Shortcut the no compression case, else we increase the amount of
1367          * storage required by a small amount
1368          */
1369         if (aa_g_rawdata_compression_level != 0) {
1370                 void *udata = data->data;
1371                 int error = compress_zstd(udata, data->size, &data->data,
1372                                           &data->compressed_size);
1373                 if (error) {
1374                         data->compressed_size = data->size;
1375                         return error;
1376                 }
1377                 if (udata != data->data)
1378                         kvfree(udata);
1379         } else
1380                 data->compressed_size = data->size;
1381
1382         return 0;
1383 }
1384
1385 /**
1386  * aa_unpack - unpack packed binary profile(s) data loaded from user space
1387  * @udata: user data copied to kmem  (NOT NULL)
1388  * @lh: list to place unpacked profiles in a aa_repl_ws
1389  * @ns: Returns namespace profile is in if specified else NULL (NOT NULL)
1390  *
1391  * Unpack user data and return refcounted allocated profile(s) stored in
1392  * @lh in order of discovery, with the list chain stored in base.list
1393  * or error
1394  *
1395  * Returns: profile(s) on @lh else error pointer if fails to unpack
1396  */
1397 int aa_unpack(struct aa_loaddata *udata, struct list_head *lh,
1398               const char **ns)
1399 {
1400         struct aa_load_ent *tmp, *ent;
1401         struct aa_profile *profile = NULL;
1402         char *ns_name = NULL;
1403         int error;
1404         struct aa_ext e = {
1405                 .start = udata->data,
1406                 .end = udata->data + udata->size,
1407                 .pos = udata->data,
1408         };
1409
1410         *ns = NULL;
1411         while (e.pos < e.end) {
1412                 void *start;
1413                 error = verify_header(&e, e.pos == e.start, ns);
1414                 if (error)
1415                         goto fail;
1416
1417                 start = e.pos;
1418                 profile = unpack_profile(&e, &ns_name);
1419                 if (IS_ERR(profile)) {
1420                         error = PTR_ERR(profile);
1421                         goto fail;
1422                 }
1423
1424                 error = verify_profile(profile);
1425                 if (error)
1426                         goto fail_profile;
1427
1428                 if (aa_g_hash_policy)
1429                         error = aa_calc_profile_hash(profile, e.version, start,
1430                                                      e.pos - start);
1431                 if (error)
1432                         goto fail_profile;
1433
1434                 ent = aa_load_ent_alloc();
1435                 if (!ent) {
1436                         error = -ENOMEM;
1437                         goto fail_profile;
1438                 }
1439
1440                 ent->new = profile;
1441                 ent->ns_name = ns_name;
1442                 ns_name = NULL;
1443                 list_add_tail(&ent->list, lh);
1444         }
1445         udata->abi = e.version & K_ABI_MASK;
1446         if (aa_g_hash_policy) {
1447                 udata->hash = aa_calc_hash(udata->data, udata->size);
1448                 if (IS_ERR(udata->hash)) {
1449                         error = PTR_ERR(udata->hash);
1450                         udata->hash = NULL;
1451                         goto fail;
1452                 }
1453         }
1454
1455         if (aa_g_export_binary) {
1456                 error = compress_loaddata(udata);
1457                 if (error)
1458                         goto fail;
1459         }
1460         return 0;
1461
1462 fail_profile:
1463         kfree(ns_name);
1464         aa_put_profile(profile);
1465
1466 fail:
1467         list_for_each_entry_safe(ent, tmp, lh, list) {
1468                 list_del_init(&ent->list);
1469                 aa_load_ent_free(ent);
1470         }
1471
1472         return error;
1473 }