security/apparmor/policy_unpack.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * AppArmor security module
   4  *
   5  * This file contains AppArmor functions for unpacking policy loaded from
   6  * userspace.
   7  *
   8  * Copyright (C) 1998-2008 Novell/SUSE
   9  * Copyright 2009-2010 Canonical Ltd.
  10  *
  11  * AppArmor uses a serialized binary format for loading policy. To find
  12  * policy format documentation see Documentation/admin-guide/LSM/apparmor.rst
  13  * All policy is validated before it is used.
  14  */
  15
  16 #include <asm/unaligned.h>
  17 #include <kunit/visibility.h>
  18 #include <linux/ctype.h>
  19 #include <linux/errno.h>
  20 #include <linux/zstd.h>
  21
  22 #include "include/apparmor.h"
  23 #include "include/audit.h"
  24 #include "include/cred.h"
  25 #include "include/crypto.h"
  26 #include "include/file.h"
  27 #include "include/match.h"
  28 #include "include/path.h"
  29 #include "include/policy.h"
  30 #include "include/policy_unpack.h"
  31 #include "include/policy_compat.h"
  32
  33 /* audit callback for unpack fields */
  34 static void audit_cb(struct audit_buffer *ab, void *va)
  35 {
  36         struct common_audit_data *sa = va;
  37
  38         if (aad(sa)->iface.ns) {
  39                 audit_log_format(ab, " ns=");
  40                 audit_log_untrustedstring(ab, aad(sa)->iface.ns);
  41         }
  42         if (aad(sa)->name) {
  43                 audit_log_format(ab, " name=");
  44                 audit_log_untrustedstring(ab, aad(sa)->name);
  45         }
  46         if (aad(sa)->iface.pos)
  47                 audit_log_format(ab, " offset=%ld", aad(sa)->iface.pos);
  48 }
  49
  50 /**
  51  * audit_iface - do audit message for policy unpacking/load/replace/remove
  52  * @new: profile if it has been allocated (MAYBE NULL)
  53  * @ns_name: name of the ns the profile is to be loaded to (MAY BE NULL)
  54  * @name: name of the profile being manipulated (MAYBE NULL)
  55  * @info: any extra info about the failure (MAYBE NULL)
  56  * @e: buffer position info
  57  * @error: error code
  58  *
  59  * Returns: %0 or error
  60  */
  61 static int audit_iface(struct aa_profile *new, const char *ns_name,
  62                        const char *name, const char *info, struct aa_ext *e,
  63                        int error)
  64 {
  65         struct aa_profile *profile = labels_profile(aa_current_raw_label());
  66         DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, AA_CLASS_NONE, NULL);
  67         if (e)
  68                 aad(&sa)->iface.pos = e->pos - e->start;
  69         aad(&sa)->iface.ns = ns_name;
  70         if (new)
  71                 aad(&sa)->name = new->base.hname;
  72         else
  73                 aad(&sa)->name = name;
  74         aad(&sa)->info = info;
  75         aad(&sa)->error = error;
  76
  77         return aa_audit(AUDIT_APPARMOR_STATUS, profile, &sa, audit_cb);
  78 }
  79
  80 void __aa_loaddata_update(struct aa_loaddata *data, long revision)
  81 {
  82         AA_BUG(!data);
  83         AA_BUG(!data->ns);
  84         AA_BUG(!mutex_is_locked(&data->ns->lock));
  85         AA_BUG(data->revision > revision);
  86
  87         data->revision = revision;
  88         if ((data->dents[AAFS_LOADDATA_REVISION])) {
  89                 struct inode *inode;
  90
  91                 inode = d_inode(data->dents[AAFS_LOADDATA_DIR]);
  92                 inode->i_mtime = inode_set_ctime_current(inode);
  93
  94                 inode = d_inode(data->dents[AAFS_LOADDATA_REVISION]);
  95                 inode->i_mtime = inode_set_ctime_current(inode);
  96         }
  97 }
  98
  99 bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r)
 100 {
 101         if (l->size != r->size)
 102                 return false;
 103         if (l->compressed_size != r->compressed_size)
 104                 return false;
 105         if (aa_g_hash_policy && memcmp(l->hash, r->hash, aa_hash_size()) != 0)
 106                 return false;
 107         return memcmp(l->data, r->data, r->compressed_size ?: r->size) == 0;
 108 }
 109
 110 /*
 111  * need to take the ns mutex lock which is NOT safe most places that
 112  * put_loaddata is called, so we have to delay freeing it
 113  */
 114 static void do_loaddata_free(struct work_struct *work)
 115 {
 116         struct aa_loaddata *d = container_of(work, struct aa_loaddata, work);
 117         struct aa_ns *ns = aa_get_ns(d->ns);
 118
 119         if (ns) {
 120                 mutex_lock_nested(&ns->lock, ns->level);
 121                 __aa_fs_remove_rawdata(d);
 122                 mutex_unlock(&ns->lock);
 123                 aa_put_ns(ns);
 124         }
 125
 126         kfree_sensitive(d->hash);
 127         kfree_sensitive(d->name);
 128         kvfree(d->data);
 129         kfree_sensitive(d);
 130 }
 131
 132 void aa_loaddata_kref(struct kref *kref)
 133 {
 134         struct aa_loaddata *d = container_of(kref, struct aa_loaddata, count);
 135
 136         if (d) {
 137                 INIT_WORK(&d->work, do_loaddata_free);
 138                 schedule_work(&d->work);
 139         }
 140 }
 141
 142 struct aa_loaddata *aa_loaddata_alloc(size_t size)
 143 {
 144         struct aa_loaddata *d;
 145
 146         d = kzalloc(sizeof(*d), GFP_KERNEL);
 147         if (d == NULL)
 148                 return ERR_PTR(-ENOMEM);
 149         d->data = kvzalloc(size, GFP_KERNEL);
 150         if (!d->data) {
 151                 kfree(d);
 152                 return ERR_PTR(-ENOMEM);
 153         }
 154         kref_init(&d->count);
 155         INIT_LIST_HEAD(&d->list);
 156
 157         return d;
 158 }
 159
 160 /* test if read will be in packed data bounds */
 161 VISIBLE_IF_KUNIT bool aa_inbounds(struct aa_ext *e, size_t size)
 162 {
 163         return (size <= e->end - e->pos);
 164 }
 165 EXPORT_SYMBOL_IF_KUNIT(aa_inbounds);
 166
 167 /**
 168  * aa_unpack_u16_chunk - test and do bounds checking for a u16 size based chunk
 169  * @e: serialized data read head (NOT NULL)
 170  * @chunk: start address for chunk of data (NOT NULL)
 171  *
 172  * Returns: the size of chunk found with the read head at the end of the chunk.
 173  */
 174 VISIBLE_IF_KUNIT size_t aa_unpack_u16_chunk(struct aa_ext *e, char **chunk)
 175 {
 176         size_t size = 0;
 177         void *pos = e->pos;
 178
 179         if (!aa_inbounds(e, sizeof(u16)))
 180                 goto fail;
 181         size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
 182         e->pos += sizeof(__le16);
 183         if (!aa_inbounds(e, size))
 184                 goto fail;
 185         *chunk = e->pos;
 186         e->pos += size;
 187         return size;
 188
 189 fail:
 190         e->pos = pos;
 191         return 0;
 192 }
 193 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u16_chunk);
 194
 195 /* unpack control byte */
 196 VISIBLE_IF_KUNIT bool aa_unpack_X(struct aa_ext *e, enum aa_code code)
 197 {
 198         if (!aa_inbounds(e, 1))
 199                 return false;
 200         if (*(u8 *) e->pos != code)
 201                 return false;
 202         e->pos++;
 203         return true;
 204 }
 205 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_X);
 206
 207 /**
 208  * aa_unpack_nameX - check is the next element is of type X with a name of @name
 209  * @e: serialized data extent information  (NOT NULL)
 210  * @code: type code
 211  * @name: name to match to the serialized element.  (MAYBE NULL)
 212  *
 213  * check that the next serialized data element is of type X and has a tag
 214  * name @name.  If @name is specified then there must be a matching
 215  * name element in the stream.  If @name is NULL any name element will be
 216  * skipped and only the typecode will be tested.
 217  *
 218  * Returns true on success (both type code and name tests match) and the read
 219  * head is advanced past the headers
 220  *
 221  * Returns: false if either match fails, the read head does not move
 222  */
 223 VISIBLE_IF_KUNIT bool aa_unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
 224 {
 225         /*
 226          * May need to reset pos if name or type doesn't match
 227          */
 228         void *pos = e->pos;
 229         /*
 230          * Check for presence of a tagname, and if present name size
 231          * AA_NAME tag value is a u16.
 232          */
 233         if (aa_unpack_X(e, AA_NAME)) {
 234                 char *tag = NULL;
 235                 size_t size = aa_unpack_u16_chunk(e, &tag);
 236                 /* if a name is specified it must match. otherwise skip tag */
 237                 if (name && (!size || tag[size-1] != '\0' || strcmp(name, tag)))
 238                         goto fail;
 239         } else if (name) {
 240                 /* if a name is specified and there is no name tag fail */
 241                 goto fail;
 242         }
 243
 244         /* now check if type code matches */
 245         if (aa_unpack_X(e, code))
 246                 return true;
 247
 248 fail:
 249         e->pos = pos;
 250         return false;
 251 }
 252 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_nameX);
 253
 254 static bool unpack_u8(struct aa_ext *e, u8 *data, const char *name)
 255 {
 256         void *pos = e->pos;
 257
 258         if (aa_unpack_nameX(e, AA_U8, name)) {
 259                 if (!aa_inbounds(e, sizeof(u8)))
 260                         goto fail;
 261                 if (data)
 262                         *data = *((u8 *)e->pos);
 263                 e->pos += sizeof(u8);
 264                 return true;
 265         }
 266
 267 fail:
 268         e->pos = pos;
 269         return false;
 270 }
 271
 272 VISIBLE_IF_KUNIT bool aa_unpack_u32(struct aa_ext *e, u32 *data, const char *name)
 273 {
 274         void *pos = e->pos;
 275
 276         if (aa_unpack_nameX(e, AA_U32, name)) {
 277                 if (!aa_inbounds(e, sizeof(u32)))
 278                         goto fail;
 279                 if (data)
 280                         *data = le32_to_cpu(get_unaligned((__le32 *) e->pos));
 281                 e->pos += sizeof(u32);
 282                 return true;
 283         }
 284
 285 fail:
 286         e->pos = pos;
 287         return false;
 288 }
 289 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u32);
 290
 291 VISIBLE_IF_KUNIT bool aa_unpack_u64(struct aa_ext *e, u64 *data, const char *name)
 292 {
 293         void *pos = e->pos;
 294
 295         if (aa_unpack_nameX(e, AA_U64, name)) {
 296                 if (!aa_inbounds(e, sizeof(u64)))
 297                         goto fail;
 298                 if (data)
 299                         *data = le64_to_cpu(get_unaligned((__le64 *) e->pos));
 300                 e->pos += sizeof(u64);
 301                 return true;
 302         }
 303
 304 fail:
 305         e->pos = pos;
 306         return false;
 307 }
 308 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u64);
 309
 310 static bool aa_unpack_cap_low(struct aa_ext *e, kernel_cap_t *data, const char *name)
 311 {
 312         u32 val;
 313
 314         if (!aa_unpack_u32(e, &val, name))
 315                 return false;
 316         data->val = val;
 317         return true;
 318 }
 319
 320 static bool aa_unpack_cap_high(struct aa_ext *e, kernel_cap_t *data, const char *name)
 321 {
 322         u32 val;
 323
 324         if (!aa_unpack_u32(e, &val, name))
 325                 return false;
 326         data->val = (u32)data->val | ((u64)val << 32);
 327         return true;
 328 }
 329
 330 VISIBLE_IF_KUNIT bool aa_unpack_array(struct aa_ext *e, const char *name, u16 *size)
 331 {
 332         void *pos = e->pos;
 333
 334         if (aa_unpack_nameX(e, AA_ARRAY, name)) {
 335                 if (!aa_inbounds(e, sizeof(u16)))
 336                         goto fail;
 337                 *size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
 338                 e->pos += sizeof(u16);
 339                 return true;
 340         }
 341
 342 fail:
 343         e->pos = pos;
 344         return false;
 345 }
 346 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_array);
 347
 348 VISIBLE_IF_KUNIT size_t aa_unpack_blob(struct aa_ext *e, char **blob, const char *name)
 349 {
 350         void *pos = e->pos;
 351
 352         if (aa_unpack_nameX(e, AA_BLOB, name)) {
 353                 u32 size;
 354                 if (!aa_inbounds(e, sizeof(u32)))
 355                         goto fail;
 356                 size = le32_to_cpu(get_unaligned((__le32 *) e->pos));
 357                 e->pos += sizeof(u32);
 358                 if (aa_inbounds(e, (size_t) size)) {
 359                         *blob = e->pos;
 360                         e->pos += size;
 361                         return size;
 362                 }
 363         }
 364
 365 fail:
 366         e->pos = pos;
 367         return 0;
 368 }
 369 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_blob);
 370
 371 VISIBLE_IF_KUNIT int aa_unpack_str(struct aa_ext *e, const char **string, const char *name)
 372 {
 373         char *src_str;
 374         size_t size = 0;
 375         void *pos = e->pos;
 376         *string = NULL;
 377         if (aa_unpack_nameX(e, AA_STRING, name)) {
 378                 size = aa_unpack_u16_chunk(e, &src_str);
 379                 if (size) {
 380                         /* strings are null terminated, length is size - 1 */
 381                         if (src_str[size - 1] != 0)
 382                                 goto fail;
 383                         *string = src_str;
 384
 385                         return size;
 386                 }
 387         }
 388
 389 fail:
 390         e->pos = pos;
 391         return 0;
 392 }
 393 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_str);
 394
 395 VISIBLE_IF_KUNIT int aa_unpack_strdup(struct aa_ext *e, char **string, const char *name)
 396 {
 397         const char *tmp;
 398         void *pos = e->pos;
 399         int res = aa_unpack_str(e, &tmp, name);
 400         *string = NULL;
 401
 402         if (!res)
 403                 return 0;
 404
 405         *string = kmemdup(tmp, res, GFP_KERNEL);
 406         if (!*string) {
 407                 e->pos = pos;
 408                 return 0;
 409         }
 410
 411         return res;
 412 }
 413 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_strdup);
 414
 415
 416 /**
 417  * unpack_dfa - unpack a file rule dfa
 418  * @e: serialized data extent information (NOT NULL)
 419  * @flags: dfa flags to check
 420  *
 421  * returns dfa or ERR_PTR or NULL if no dfa
 422  */
 423 static struct aa_dfa *unpack_dfa(struct aa_ext *e, int flags)
 424 {
 425         char *blob = NULL;
 426         size_t size;
 427         struct aa_dfa *dfa = NULL;
 428
 429         size = aa_unpack_blob(e, &blob, "aadfa");
 430         if (size) {
 431                 /*
 432                  * The dfa is aligned with in the blob to 8 bytes
 433                  * from the beginning of the stream.
 434                  * alignment adjust needed by dfa unpack
 435                  */
 436                 size_t sz = blob - (char *) e->start -
 437                         ((e->pos - e->start) & 7);
 438                 size_t pad = ALIGN(sz, 8) - sz;
 439                 if (aa_g_paranoid_load)
 440                         flags |= DFA_FLAG_VERIFY_STATES;
 441                 dfa = aa_dfa_unpack(blob + pad, size - pad, flags);
 442
 443                 if (IS_ERR(dfa))
 444                         return dfa;
 445
 446         }
 447
 448         return dfa;
 449 }
 450
 451 /**
 452  * unpack_trans_table - unpack a profile transition table
 453  * @e: serialized data extent information  (NOT NULL)
 454  * @strs: str table to unpack to (NOT NULL)
 455  *
 456  * Returns: true if table successfully unpacked or not present
 457  */
 458 static bool unpack_trans_table(struct aa_ext *e, struct aa_str_table *strs)
 459 {
 460         void *saved_pos = e->pos;
 461         char **table = NULL;
 462
 463         /* exec table is optional */
 464         if (aa_unpack_nameX(e, AA_STRUCT, "xtable")) {
 465                 u16 size;
 466                 int i;
 467
 468                 if (!aa_unpack_array(e, NULL, &size))
 469                         /*
 470                          * Note: index into trans table array is a max
 471                          * of 2^24, but unpack array can only unpack
 472                          * an array of 2^16 in size atm so no need
 473                          * for size check here
 474                          */
 475                         goto fail;
 476                 table = kcalloc(size, sizeof(char *), GFP_KERNEL);
 477                 if (!table)
 478                         goto fail;
 479
 480                 for (i = 0; i < size; i++) {
 481                         char *str;
 482                         int c, j, pos, size2 = aa_unpack_strdup(e, &str, NULL);
 483                         /* aa_unpack_strdup verifies that the last character is
 484                          * null termination byte.
 485                          */
 486                         if (!size2)
 487                                 goto fail;
 488                         table[i] = str;
 489                         /* verify that name doesn't start with space */
 490                         if (isspace(*str))
 491                                 goto fail;
 492
 493                         /* count internal #  of internal \0 */
 494                         for (c = j = 0; j < size2 - 1; j++) {
 495                                 if (!str[j]) {
 496                                         pos = j;
 497                                         c++;
 498                                 }
 499                         }
 500                         if (*str == ':') {
 501                                 /* first character after : must be valid */
 502                                 if (!str[1])
 503                                         goto fail;
 504                                 /* beginning with : requires an embedded \0,
 505                                  * verify that exactly 1 internal \0 exists
 506                                  * trailing \0 already verified by aa_unpack_strdup
 507                                  *
 508                                  * convert \0 back to : for label_parse
 509                                  */
 510                                 if (c == 1)
 511                                         str[pos] = ':';
 512                                 else if (c > 1)
 513                                         goto fail;
 514                         } else if (c)
 515                                 /* fail - all other cases with embedded \0 */
 516                                 goto fail;
 517                 }
 518                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 519                         goto fail;
 520                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 521                         goto fail;
 522
 523                 strs->table = table;
 524                 strs->size = size;
 525         }
 526         return true;
 527
 528 fail:
 529         kfree_sensitive(table);
 530         e->pos = saved_pos;
 531         return false;
 532 }
 533
 534 static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)
 535 {
 536         void *pos = e->pos;
 537
 538         if (aa_unpack_nameX(e, AA_STRUCT, "xattrs")) {
 539                 u16 size;
 540                 int i;
 541
 542                 if (!aa_unpack_array(e, NULL, &size))
 543                         goto fail;
 544                 profile->attach.xattr_count = size;
 545                 profile->attach.xattrs = kcalloc(size, sizeof(char *), GFP_KERNEL);
 546                 if (!profile->attach.xattrs)
 547                         goto fail;
 548                 for (i = 0; i < size; i++) {
 549                         if (!aa_unpack_strdup(e, &profile->attach.xattrs[i], NULL))
 550                                 goto fail;
 551                 }
 552                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 553                         goto fail;
 554                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 555                         goto fail;
 556         }
 557
 558         return true;
 559
 560 fail:
 561         e->pos = pos;
 562         return false;
 563 }
 564
 565 static bool unpack_secmark(struct aa_ext *e, struct aa_ruleset *rules)
 566 {
 567         void *pos = e->pos;
 568         u16 size;
 569         int i;
 570
 571         if (aa_unpack_nameX(e, AA_STRUCT, "secmark")) {
 572                 if (!aa_unpack_array(e, NULL, &size))
 573                         goto fail;
 574
 575                 rules->secmark = kcalloc(size, sizeof(struct aa_secmark),
 576                                            GFP_KERNEL);
 577                 if (!rules->secmark)
 578                         goto fail;
 579
 580                 rules->secmark_count = size;
 581
 582                 for (i = 0; i < size; i++) {
 583                         if (!unpack_u8(e, &rules->secmark[i].audit, NULL))
 584                                 goto fail;
 585                         if (!unpack_u8(e, &rules->secmark[i].deny, NULL))
 586                                 goto fail;
 587                         if (!aa_unpack_strdup(e, &rules->secmark[i].label, NULL))
 588                                 goto fail;
 589                 }
 590                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 591                         goto fail;
 592                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 593                         goto fail;
 594         }
 595
 596         return true;
 597
 598 fail:
 599         if (rules->secmark) {
 600                 for (i = 0; i < size; i++)
 601                         kfree(rules->secmark[i].label);
 602                 kfree(rules->secmark);
 603                 rules->secmark_count = 0;
 604                 rules->secmark = NULL;
 605         }
 606
 607         e->pos = pos;
 608         return false;
 609 }
 610
 611 static bool unpack_rlimits(struct aa_ext *e, struct aa_ruleset *rules)
 612 {
 613         void *pos = e->pos;
 614
 615         /* rlimits are optional */
 616         if (aa_unpack_nameX(e, AA_STRUCT, "rlimits")) {
 617                 u16 size;
 618                 int i;
 619                 u32 tmp = 0;
 620                 if (!aa_unpack_u32(e, &tmp, NULL))
 621                         goto fail;
 622                 rules->rlimits.mask = tmp;
 623
 624                 if (!aa_unpack_array(e, NULL, &size) ||
 625                     size > RLIM_NLIMITS)
 626                         goto fail;
 627                 for (i = 0; i < size; i++) {
 628                         u64 tmp2 = 0;
 629                         int a = aa_map_resource(i);
 630                         if (!aa_unpack_u64(e, &tmp2, NULL))
 631                                 goto fail;
 632                         rules->rlimits.limits[a].rlim_max = tmp2;
 633                 }
 634                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 635                         goto fail;
 636                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 637                         goto fail;
 638         }
 639         return true;
 640
 641 fail:
 642         e->pos = pos;
 643         return false;
 644 }
 645
 646 static bool unpack_perm(struct aa_ext *e, u32 version, struct aa_perms *perm)
 647 {
 648         if (version != 1)
 649                 return false;
 650
 651         return  aa_unpack_u32(e, &perm->allow, NULL) &&
 652                 aa_unpack_u32(e, &perm->allow, NULL) &&
 653                 aa_unpack_u32(e, &perm->deny, NULL) &&
 654                 aa_unpack_u32(e, &perm->subtree, NULL) &&
 655                 aa_unpack_u32(e, &perm->cond, NULL) &&
 656                 aa_unpack_u32(e, &perm->kill, NULL) &&
 657                 aa_unpack_u32(e, &perm->complain, NULL) &&
 658                 aa_unpack_u32(e, &perm->prompt, NULL) &&
 659                 aa_unpack_u32(e, &perm->audit, NULL) &&
 660                 aa_unpack_u32(e, &perm->quiet, NULL) &&
 661                 aa_unpack_u32(e, &perm->hide, NULL) &&
 662                 aa_unpack_u32(e, &perm->xindex, NULL) &&
 663                 aa_unpack_u32(e, &perm->tag, NULL) &&
 664                 aa_unpack_u32(e, &perm->label, NULL);
 665 }
 666
 667 static ssize_t unpack_perms_table(struct aa_ext *e, struct aa_perms **perms)
 668 {
 669         void *pos = e->pos;
 670         u16 size = 0;
 671
 672         AA_BUG(!perms);
 673         /*
 674          * policy perms are optional, in which case perms are embedded
 675          * in the dfa accept table
 676          */
 677         if (aa_unpack_nameX(e, AA_STRUCT, "perms")) {
 678                 int i;
 679                 u32 version;
 680
 681                 if (!aa_unpack_u32(e, &version, "version"))
 682                         goto fail_reset;
 683                 if (!aa_unpack_array(e, NULL, &size))
 684                         goto fail_reset;
 685                 *perms = kcalloc(size, sizeof(struct aa_perms), GFP_KERNEL);
 686                 if (!*perms)
 687                         goto fail_reset;
 688                 for (i = 0; i < size; i++) {
 689                         if (!unpack_perm(e, version, &(*perms)[i]))
 690                                 goto fail;
 691                 }
 692                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 693                         goto fail;
 694                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 695                         goto fail;
 696         } else
 697                 *perms = NULL;
 698
 699         return size;
 700
 701 fail:
 702         kfree(*perms);
 703 fail_reset:
 704         e->pos = pos;
 705         return -EPROTO;
 706 }
 707
 708 static int unpack_pdb(struct aa_ext *e, struct aa_policydb *policy,
 709                       bool required_dfa, bool required_trans,
 710                       const char **info)
 711 {
 712         void *pos = e->pos;
 713         int i, flags, error = -EPROTO;
 714         ssize_t size;
 715
 716         size = unpack_perms_table(e, &policy->perms);
 717         if (size < 0) {
 718                 error = size;
 719                 policy->perms = NULL;
 720                 *info = "failed to unpack - perms";
 721                 goto fail;
 722         }
 723         policy->size = size;
 724
 725         if (policy->perms) {
 726                 /* perms table present accept is index */
 727                 flags = TO_ACCEPT1_FLAG(YYTD_DATA32);
 728         } else {
 729                 /* packed perms in accept1 and accept2 */
 730                 flags = TO_ACCEPT1_FLAG(YYTD_DATA32) |
 731                         TO_ACCEPT2_FLAG(YYTD_DATA32);
 732         }
 733
 734         policy->dfa = unpack_dfa(e, flags);
 735         if (IS_ERR(policy->dfa)) {
 736                 error = PTR_ERR(policy->dfa);
 737                 policy->dfa = NULL;
 738                 *info = "failed to unpack - dfa";
 739                 goto fail;
 740         } else if (!policy->dfa) {
 741                 if (required_dfa) {
 742                         *info = "missing required dfa";
 743                         goto fail;
 744                 }
 745                 goto out;
 746         }
 747
 748         /*
 749          * only unpack the following if a dfa is present
 750          *
 751          * sadly start was given different names for file and policydb
 752          * but since it is optional we can try both
 753          */
 754         if (!aa_unpack_u32(e, &policy->start[0], "start"))
 755                 /* default start state */
 756                 policy->start[0] = DFA_START;
 757         if (!aa_unpack_u32(e, &policy->start[AA_CLASS_FILE], "dfa_start")) {
 758                 /* default start state for xmatch and file dfa */
 759                 policy->start[AA_CLASS_FILE] = DFA_START;
 760         }       /* setup class index */
 761         for (i = AA_CLASS_FILE + 1; i <= AA_CLASS_LAST; i++) {
 762                 policy->start[i] = aa_dfa_next(policy->dfa, policy->start[0],
 763                                                i);
 764         }
 765         if (!unpack_trans_table(e, &policy->trans) && required_trans) {
 766                 *info = "failed to unpack profile transition table";
 767                 goto fail;
 768         }
 769
 770         /* TODO: move compat mapping here, requires dfa merging first */
 771         /* TODO: move verify here, it has to be done after compat mappings */
 772 out:
 773         return 0;
 774
 775 fail:
 776         e->pos = pos;
 777         return error;
 778 }
 779
 780 static u32 strhash(const void *data, u32 len, u32 seed)
 781 {
 782         const char * const *key = data;
 783
 784         return jhash(*key, strlen(*key), seed);
 785 }
 786
 787 static int datacmp(struct rhashtable_compare_arg *arg, const void *obj)
 788 {
 789         const struct aa_data *data = obj;
 790         const char * const *key = arg->key;
 791
 792         return strcmp(data->key, *key);
 793 }
 794
 795 /**
 796  * unpack_profile - unpack a serialized profile
 797  * @e: serialized data extent information (NOT NULL)
 798  * @ns_name: pointer of newly allocated copy of %NULL in case of error
 799  *
 800  * NOTE: unpack profile sets audit struct if there is a failure
 801  */
 802 static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
 803 {
 804         struct aa_ruleset *rules;
 805         struct aa_profile *profile = NULL;
 806         const char *tmpname, *tmpns = NULL, *name = NULL;
 807         const char *info = "failed to unpack profile";
 808         size_t ns_len;
 809         struct rhashtable_params params = { 0 };
 810         char *key = NULL;
 811         struct aa_data *data;
 812         int error = -EPROTO;
 813         kernel_cap_t tmpcap;
 814         u32 tmp;
 815
 816         *ns_name = NULL;
 817
 818         /* check that we have the right struct being passed */
 819         if (!aa_unpack_nameX(e, AA_STRUCT, "profile"))
 820                 goto fail;
 821         if (!aa_unpack_str(e, &name, NULL))
 822                 goto fail;
 823         if (*name == '\0')
 824                 goto fail;
 825
 826         tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len);
 827         if (tmpns) {
 828                 *ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL);
 829                 if (!*ns_name) {
 830                         info = "out of memory";
 831                         error = -ENOMEM;
 832                         goto fail;
 833                 }
 834                 name = tmpname;
 835         }
 836
 837         profile = aa_alloc_profile(name, NULL, GFP_KERNEL);
 838         if (!profile) {
 839                 info = "out of memory";
 840                 error = -ENOMEM;
 841                 goto fail;
 842         }
 843         rules = list_first_entry(&profile->rules, typeof(*rules), list);
 844
 845         /* profile renaming is optional */
 846         (void) aa_unpack_str(e, &profile->rename, "rename");
 847
 848         /* attachment string is optional */
 849         (void) aa_unpack_str(e, &profile->attach.xmatch_str, "attach");
 850
 851         /* xmatch is optional and may be NULL */
 852         error = unpack_pdb(e, &profile->attach.xmatch, false, false, &info);
 853         if (error) {
 854                 info = "bad xmatch";
 855                 goto fail;
 856         }
 857
 858         /* neither xmatch_len not xmatch_perms are optional if xmatch is set */
 859         if (profile->attach.xmatch.dfa) {
 860                 if (!aa_unpack_u32(e, &tmp, NULL)) {
 861                         info = "missing xmatch len";
 862                         goto fail;
 863                 }
 864                 profile->attach.xmatch_len = tmp;
 865                 profile->attach.xmatch.start[AA_CLASS_XMATCH] = DFA_START;
 866                 if (!profile->attach.xmatch.perms) {
 867                         error = aa_compat_map_xmatch(&profile->attach.xmatch);
 868                         if (error) {
 869                                 info = "failed to convert xmatch permission table";
 870                                 goto fail;
 871                         }
 872                 }
 873         }
 874
 875         /* disconnected attachment string is optional */
 876         (void) aa_unpack_str(e, &profile->disconnected, "disconnected");
 877
 878         /* per profile debug flags (complain, audit) */
 879         if (!aa_unpack_nameX(e, AA_STRUCT, "flags")) {
 880                 info = "profile missing flags";
 881                 goto fail;
 882         }
 883         info = "failed to unpack profile flags";
 884         if (!aa_unpack_u32(e, &tmp, NULL))
 885                 goto fail;
 886         if (tmp & PACKED_FLAG_HAT)
 887                 profile->label.flags |= FLAG_HAT;
 888         if (tmp & PACKED_FLAG_DEBUG1)
 889                 profile->label.flags |= FLAG_DEBUG1;
 890         if (tmp & PACKED_FLAG_DEBUG2)
 891                 profile->label.flags |= FLAG_DEBUG2;
 892         if (!aa_unpack_u32(e, &tmp, NULL))
 893                 goto fail;
 894         if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) {
 895                 profile->mode = APPARMOR_COMPLAIN;
 896         } else if (tmp == PACKED_MODE_ENFORCE) {
 897                 profile->mode = APPARMOR_ENFORCE;
 898         } else if (tmp == PACKED_MODE_KILL) {
 899                 profile->mode = APPARMOR_KILL;
 900         } else if (tmp == PACKED_MODE_UNCONFINED) {
 901                 profile->mode = APPARMOR_UNCONFINED;
 902                 profile->label.flags |= FLAG_UNCONFINED;
 903         } else if (tmp == PACKED_MODE_USER) {
 904                 profile->mode = APPARMOR_USER;
 905         } else {
 906                 goto fail;
 907         }
 908         if (!aa_unpack_u32(e, &tmp, NULL))
 909                 goto fail;
 910         if (tmp)
 911                 profile->audit = AUDIT_ALL;
 912
 913         if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 914                 goto fail;
 915
 916         /* path_flags is optional */
 917         if (aa_unpack_u32(e, &profile->path_flags, "path_flags"))
 918                 profile->path_flags |= profile->label.flags &
 919                         PATH_MEDIATE_DELETED;
 920         else
 921                 /* set a default value if path_flags field is not present */
 922                 profile->path_flags = PATH_MEDIATE_DELETED;
 923
 924         info = "failed to unpack profile capabilities";
 925         if (!aa_unpack_cap_low(e, &rules->caps.allow, NULL))
 926                 goto fail;
 927         if (!aa_unpack_cap_low(e, &rules->caps.audit, NULL))
 928                 goto fail;
 929         if (!aa_unpack_cap_low(e, &rules->caps.quiet, NULL))
 930                 goto fail;
 931         if (!aa_unpack_cap_low(e, &tmpcap, NULL))
 932                 goto fail;
 933
 934         info = "failed to unpack upper profile capabilities";
 935         if (aa_unpack_nameX(e, AA_STRUCT, "caps64")) {
 936                 /* optional upper half of 64 bit caps */
 937                 if (!aa_unpack_cap_high(e, &rules->caps.allow, NULL))
 938                         goto fail;
 939                 if (!aa_unpack_cap_high(e, &rules->caps.audit, NULL))
 940                         goto fail;
 941                 if (!aa_unpack_cap_high(e, &rules->caps.quiet, NULL))
 942                         goto fail;
 943                 if (!aa_unpack_cap_high(e, &tmpcap, NULL))
 944                         goto fail;
 945                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 946                         goto fail;
 947         }
 948
 949         info = "failed to unpack extended profile capabilities";
 950         if (aa_unpack_nameX(e, AA_STRUCT, "capsx")) {
 951                 /* optional extended caps mediation mask */
 952                 if (!aa_unpack_cap_low(e, &rules->caps.extended, NULL))
 953                         goto fail;
 954                 if (!aa_unpack_cap_high(e, &rules->caps.extended, NULL))
 955                         goto fail;
 956                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 957                         goto fail;
 958         }
 959
 960         if (!unpack_xattrs(e, profile)) {
 961                 info = "failed to unpack profile xattrs";
 962                 goto fail;
 963         }
 964
 965         if (!unpack_rlimits(e, rules)) {
 966                 info = "failed to unpack profile rlimits";
 967                 goto fail;
 968         }
 969
 970         if (!unpack_secmark(e, rules)) {
 971                 info = "failed to unpack profile secmark rules";
 972                 goto fail;
 973         }
 974
 975         if (aa_unpack_nameX(e, AA_STRUCT, "policydb")) {
 976                 /* generic policy dfa - optional and may be NULL */
 977                 info = "failed to unpack policydb";
 978                 error = unpack_pdb(e, &rules->policy, true, false,
 979                                    &info);
 980                 if (error)
 981                         goto fail;
 982                 /* Fixup: drop when we get rid of start array */
 983                 if (aa_dfa_next(rules->policy.dfa, rules->policy.start[0],
 984                                 AA_CLASS_FILE))
 985                         rules->policy.start[AA_CLASS_FILE] =
 986                           aa_dfa_next(rules->policy.dfa,
 987                                       rules->policy.start[0],
 988                                       AA_CLASS_FILE);
 989                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 990                         goto fail;
 991                 if (!rules->policy.perms) {
 992                         error = aa_compat_map_policy(&rules->policy,
 993                                                      e->version);
 994                         if (error) {
 995                                 info = "failed to remap policydb permission table";
 996                                 goto fail;
 997                         }
 998                 }
 999         } else {
1000                 rules->policy.dfa = aa_get_dfa(nulldfa);
1001                 rules->policy.perms = kcalloc(2, sizeof(struct aa_perms),
1002                                               GFP_KERNEL);
1003                 if (!rules->policy.perms)
1004                         goto fail;
1005                 rules->policy.size = 2;
1006         }
1007         /* get file rules */
1008         error = unpack_pdb(e, &rules->file, false, true, &info);
1009         if (error) {
1010                 goto fail;
1011         } else if (rules->file.dfa) {
1012                 if (!rules->file.perms) {
1013                         error = aa_compat_map_file(&rules->file);
1014                         if (error) {
1015                                 info = "failed to remap file permission table";
1016                                 goto fail;
1017                         }
1018                 }
1019         } else if (rules->policy.dfa &&
1020                    rules->policy.start[AA_CLASS_FILE]) {
1021                 rules->file.dfa = aa_get_dfa(rules->policy.dfa);
1022                 rules->file.start[AA_CLASS_FILE] = rules->policy.start[AA_CLASS_FILE];
1023                 rules->file.perms = kcalloc(rules->policy.size,
1024                                             sizeof(struct aa_perms),
1025                                             GFP_KERNEL);
1026                 if (!rules->file.perms)
1027                         goto fail;
1028                 memcpy(rules->file.perms, rules->policy.perms,
1029                        rules->policy.size * sizeof(struct aa_perms));
1030                 rules->file.size = rules->policy.size;
1031         } else {
1032                 rules->file.dfa = aa_get_dfa(nulldfa);
1033                 rules->file.perms = kcalloc(2, sizeof(struct aa_perms),
1034                                             GFP_KERNEL);
1035                 if (!rules->file.perms)
1036                         goto fail;
1037                 rules->file.size = 2;
1038         }
1039         error = -EPROTO;
1040         if (aa_unpack_nameX(e, AA_STRUCT, "data")) {
1041                 info = "out of memory";
1042                 profile->data = kzalloc(sizeof(*profile->data), GFP_KERNEL);
1043                 if (!profile->data) {
1044                         error = -ENOMEM;
1045                         goto fail;
1046                 }
1047                 params.nelem_hint = 3;
1048                 params.key_len = sizeof(void *);
1049                 params.key_offset = offsetof(struct aa_data, key);
1050                 params.head_offset = offsetof(struct aa_data, head);
1051                 params.hashfn = strhash;
1052                 params.obj_cmpfn = datacmp;
1053
1054                 if (rhashtable_init(profile->data, &params)) {
1055                         info = "failed to init key, value hash table";
1056                         goto fail;
1057                 }
1058
1059                 while (aa_unpack_strdup(e, &key, NULL)) {
1060                         data = kzalloc(sizeof(*data), GFP_KERNEL);
1061                         if (!data) {
1062                                 kfree_sensitive(key);
1063                                 error = -ENOMEM;
1064                                 goto fail;
1065                         }
1066
1067                         data->key = key;
1068                         data->size = aa_unpack_blob(e, &data->data, NULL);
1069                         data->data = kvmemdup(data->data, data->size, GFP_KERNEL);
1070                         if (data->size && !data->data) {
1071                                 kfree_sensitive(data->key);
1072                                 kfree_sensitive(data);
1073                                 error = -ENOMEM;
1074                                 goto fail;
1075                         }
1076
1077                         if (rhashtable_insert_fast(profile->data, &data->head,
1078                                                    profile->data->p)) {
1079                                 kfree_sensitive(data->key);
1080                                 kfree_sensitive(data);
1081                                 info = "failed to insert data to table";
1082                                 goto fail;
1083                         }
1084                 }
1085
1086                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
1087                         info = "failed to unpack end of key, value data table";
1088                         goto fail;
1089                 }
1090         }
1091
1092         if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
1093                 info = "failed to unpack end of profile";
1094                 goto fail;
1095         }
1096
1097         return profile;
1098
1099 fail:
1100         if (error == 0)
1101                 /* default error covers most cases */
1102                 error = -EPROTO;
1103         if (*ns_name) {
1104                 kfree(*ns_name);
1105                 *ns_name = NULL;
1106         }
1107         if (profile)
1108                 name = NULL;
1109         else if (!name)
1110                 name = "unknown";
1111         audit_iface(profile, NULL, name, info, e, error);
1112         aa_free_profile(profile);
1113
1114         return ERR_PTR(error);
1115 }
1116
1117 /**
1118  * verify_header - unpack serialized stream header
1119  * @e: serialized data read head (NOT NULL)
1120  * @required: whether the header is required or optional
1121  * @ns: Returns - namespace if one is specified else NULL (NOT NULL)
1122  *
1123  * Returns: error or 0 if header is good
1124  */
1125 static int verify_header(struct aa_ext *e, int required, const char **ns)
1126 {
1127         int error = -EPROTONOSUPPORT;
1128         const char *name = NULL;
1129         *ns = NULL;
1130
1131         /* get the interface version */
1132         if (!aa_unpack_u32(e, &e->version, "version")) {
1133                 if (required) {
1134                         audit_iface(NULL, NULL, NULL, "invalid profile format",
1135                                     e, error);
1136                         return error;
1137                 }
1138         }
1139
1140         /* Check that the interface version is currently supported.
1141          * if not specified use previous version
1142          * Mask off everything that is not kernel abi version
1143          */
1144         if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v9)) {
1145                 audit_iface(NULL, NULL, NULL, "unsupported interface version",
1146                             e, error);
1147                 return error;
1148         }
1149
1150         /* read the namespace if present */
1151         if (aa_unpack_str(e, &name, "namespace")) {
1152                 if (*name == '\0') {
1153                         audit_iface(NULL, NULL, NULL, "invalid namespace name",
1154                                     e, error);
1155                         return error;
1156                 }
1157                 if (*ns && strcmp(*ns, name)) {
1158                         audit_iface(NULL, NULL, NULL, "invalid ns change", e,
1159                                     error);
1160                 } else if (!*ns) {
1161                         *ns = kstrdup(name, GFP_KERNEL);
1162                         if (!*ns)
1163                                 return -ENOMEM;
1164                 }
1165         }
1166
1167         return 0;
1168 }
1169
1170 /**
1171  * verify_dfa_accept_index - verify accept indexes are in range of perms table
1172  * @dfa: the dfa to check accept indexes are in range
1173  * table_size: the permission table size the indexes should be within
1174  */
1175 static bool verify_dfa_accept_index(struct aa_dfa *dfa, int table_size)
1176 {
1177         int i;
1178         for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
1179                 if (ACCEPT_TABLE(dfa)[i] >= table_size)
1180                         return false;
1181         }
1182         return true;
1183 }
1184
1185 static bool verify_perm(struct aa_perms *perm)
1186 {
1187         /* TODO: allow option to just force the perms into a valid state */
1188         if (perm->allow & perm->deny)
1189                 return false;
1190         if (perm->subtree & ~perm->allow)
1191                 return false;
1192         if (perm->cond & (perm->allow | perm->deny))
1193                 return false;
1194         if (perm->kill & perm->allow)
1195                 return false;
1196         if (perm->complain & (perm->allow | perm->deny))
1197                 return false;
1198         if (perm->prompt & (perm->allow | perm->deny))
1199                 return false;
1200         if (perm->complain & perm->prompt)
1201                 return false;
1202         if (perm->hide & perm->allow)
1203                 return false;
1204
1205         return true;
1206 }
1207
1208 static bool verify_perms(struct aa_policydb *pdb)
1209 {
1210         int i;
1211
1212         for (i = 0; i < pdb->size; i++) {
1213                 if (!verify_perm(&pdb->perms[i]))
1214                         return false;
1215                 /* verify indexes into str table */
1216                 if ((pdb->perms[i].xindex & AA_X_TYPE_MASK) == AA_X_TABLE &&
1217                     (pdb->perms[i].xindex & AA_X_INDEX_MASK) >= pdb->trans.size)
1218                         return false;
1219                 if (pdb->perms[i].tag && pdb->perms[i].tag >= pdb->trans.size)
1220                         return false;
1221                 if (pdb->perms[i].label &&
1222                     pdb->perms[i].label >= pdb->trans.size)
1223                         return false;
1224         }
1225
1226         return true;
1227 }
1228
1229 /**
1230  * verify_profile - Do post unpack analysis to verify profile consistency
1231  * @profile: profile to verify (NOT NULL)
1232  *
1233  * Returns: 0 if passes verification else error
1234  *
1235  * This verification is post any unpack mapping or changes
1236  */
1237 static int verify_profile(struct aa_profile *profile)
1238 {
1239         struct aa_ruleset *rules = list_first_entry(&profile->rules,
1240                                                     typeof(*rules), list);
1241         if (!rules)
1242                 return 0;
1243
1244         if ((rules->file.dfa && !verify_dfa_accept_index(rules->file.dfa,
1245                                                          rules->file.size)) ||
1246             (rules->policy.dfa &&
1247              !verify_dfa_accept_index(rules->policy.dfa, rules->policy.size))) {
1248                 audit_iface(profile, NULL, NULL,
1249                             "Unpack: Invalid named transition", NULL, -EPROTO);
1250                 return -EPROTO;
1251         }
1252
1253         if (!verify_perms(&rules->file)) {
1254                 audit_iface(profile, NULL, NULL,
1255                             "Unpack: Invalid perm index", NULL, -EPROTO);
1256                 return -EPROTO;
1257         }
1258         if (!verify_perms(&rules->policy)) {
1259                 audit_iface(profile, NULL, NULL,
1260                             "Unpack: Invalid perm index", NULL, -EPROTO);
1261                 return -EPROTO;
1262         }
1263         if (!verify_perms(&profile->attach.xmatch)) {
1264                 audit_iface(profile, NULL, NULL,
1265                             "Unpack: Invalid perm index", NULL, -EPROTO);
1266                 return -EPROTO;
1267         }
1268
1269         return 0;
1270 }
1271
1272 void aa_load_ent_free(struct aa_load_ent *ent)
1273 {
1274         if (ent) {
1275                 aa_put_profile(ent->rename);
1276                 aa_put_profile(ent->old);
1277                 aa_put_profile(ent->new);
1278                 kfree(ent->ns_name);
1279                 kfree_sensitive(ent);
1280         }
1281 }
1282
1283 struct aa_load_ent *aa_load_ent_alloc(void)
1284 {
1285         struct aa_load_ent *ent = kzalloc(sizeof(*ent), GFP_KERNEL);
1286         if (ent)
1287                 INIT_LIST_HEAD(&ent->list);
1288         return ent;
1289 }
1290
1291 static int compress_zstd(const char *src, size_t slen, char **dst, size_t *dlen)
1292 {
1293 #ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
1294         const zstd_parameters params =
1295                 zstd_get_params(aa_g_rawdata_compression_level, slen);
1296         const size_t wksp_len = zstd_cctx_workspace_bound(&params.cParams);
1297         void *wksp = NULL;
1298         zstd_cctx *ctx = NULL;
1299         size_t out_len = zstd_compress_bound(slen);
1300         void *out = NULL;
1301         int ret = 0;
1302
1303         out = kvzalloc(out_len, GFP_KERNEL);
1304         if (!out) {
1305                 ret = -ENOMEM;
1306                 goto cleanup;
1307         }
1308
1309         wksp = kvzalloc(wksp_len, GFP_KERNEL);
1310         if (!wksp) {
1311                 ret = -ENOMEM;
1312                 goto cleanup;
1313         }
1314
1315         ctx = zstd_init_cctx(wksp, wksp_len);
1316         if (!ctx) {
1317                 ret = -EINVAL;
1318                 goto cleanup;
1319         }
1320
1321         out_len = zstd_compress_cctx(ctx, out, out_len, src, slen, &params);
1322         if (zstd_is_error(out_len) || out_len >= slen) {
1323                 ret = -EINVAL;
1324                 goto cleanup;
1325         }
1326
1327         if (is_vmalloc_addr(out)) {
1328                 *dst = kvzalloc(out_len, GFP_KERNEL);
1329                 if (*dst) {
1330                         memcpy(*dst, out, out_len);
1331                         kvfree(out);
1332                         out = NULL;
1333                 }
1334         } else {
1335                 /*
1336                  * If the staging buffer was kmalloc'd, then using krealloc is
1337                  * probably going to be faster. The destination buffer will
1338                  * always be smaller, so it's just shrunk, avoiding a memcpy
1339                  */
1340                 *dst = krealloc(out, out_len, GFP_KERNEL);
1341         }
1342
1343         if (!*dst) {
1344                 ret = -ENOMEM;
1345                 goto cleanup;
1346         }
1347
1348         *dlen = out_len;
1349
1350 cleanup:
1351         if (ret) {
1352                 kvfree(out);
1353                 *dst = NULL;
1354         }
1355
1356         kvfree(wksp);
1357         return ret;
1358 #else
1359         *dlen = slen;
1360         return 0;
1361 #endif
1362 }
1363
1364 static int compress_loaddata(struct aa_loaddata *data)
1365 {
1366         AA_BUG(data->compressed_size > 0);
1367
1368         /*
1369          * Shortcut the no compression case, else we increase the amount of
1370          * storage required by a small amount
1371          */
1372         if (aa_g_rawdata_compression_level != 0) {
1373                 void *udata = data->data;
1374                 int error = compress_zstd(udata, data->size, &data->data,
1375                                           &data->compressed_size);
1376                 if (error) {
1377                         data->compressed_size = data->size;
1378                         return error;
1379                 }
1380                 if (udata != data->data)
1381                         kvfree(udata);
1382         } else
1383                 data->compressed_size = data->size;
1384
1385         return 0;
1386 }
1387
1388 /**
1389  * aa_unpack - unpack packed binary profile(s) data loaded from user space
1390  * @udata: user data copied to kmem  (NOT NULL)
1391  * @lh: list to place unpacked profiles in a aa_repl_ws
1392  * @ns: Returns namespace profile is in if specified else NULL (NOT NULL)
1393  *
1394  * Unpack user data and return refcounted allocated profile(s) stored in
1395  * @lh in order of discovery, with the list chain stored in base.list
1396  * or error
1397  *
1398  * Returns: profile(s) on @lh else error pointer if fails to unpack
1399  */
1400 int aa_unpack(struct aa_loaddata *udata, struct list_head *lh,
1401               const char **ns)
1402 {
1403         struct aa_load_ent *tmp, *ent;
1404         struct aa_profile *profile = NULL;
1405         char *ns_name = NULL;
1406         int error;
1407         struct aa_ext e = {
1408                 .start = udata->data,
1409                 .end = udata->data + udata->size,
1410                 .pos = udata->data,
1411         };
1412
1413         *ns = NULL;
1414         while (e.pos < e.end) {
1415                 void *start;
1416                 error = verify_header(&e, e.pos == e.start, ns);
1417                 if (error)
1418                         goto fail;
1419
1420                 start = e.pos;
1421                 profile = unpack_profile(&e, &ns_name);
1422                 if (IS_ERR(profile)) {
1423                         error = PTR_ERR(profile);
1424                         goto fail;
1425                 }
1426
1427                 error = verify_profile(profile);
1428                 if (error)
1429                         goto fail_profile;
1430
1431                 if (aa_g_hash_policy)
1432                         error = aa_calc_profile_hash(profile, e.version, start,
1433                                                      e.pos - start);
1434                 if (error)
1435                         goto fail_profile;
1436
1437                 ent = aa_load_ent_alloc();
1438                 if (!ent) {
1439                         error = -ENOMEM;
1440                         goto fail_profile;
1441                 }
1442
1443                 ent->new = profile;
1444                 ent->ns_name = ns_name;
1445                 ns_name = NULL;
1446                 list_add_tail(&ent->list, lh);
1447         }
1448         udata->abi = e.version & K_ABI_MASK;
1449         if (aa_g_hash_policy) {
1450                 udata->hash = aa_calc_hash(udata->data, udata->size);
1451                 if (IS_ERR(udata->hash)) {
1452                         error = PTR_ERR(udata->hash);
1453                         udata->hash = NULL;
1454                         goto fail;
1455                 }
1456         }
1457
1458         if (aa_g_export_binary) {
1459                 error = compress_loaddata(udata);
1460                 if (error)
1461                         goto fail;
1462         }
1463         return 0;
1464
1465 fail_profile:
1466         kfree(ns_name);
1467         aa_put_profile(profile);
1468
1469 fail:
1470         list_for_each_entry_safe(ent, tmp, lh, list) {
1471                 list_del_init(&ent->list);
1472                 aa_load_ent_free(ent);
1473         }
1474
1475         return error;
1476 }