apparmor: Fix use-after-free in aa_audit_rule_init
authorNavid Emamdoost <navid.emamdoost@gmail.com>
Mon, 21 Oct 2019 15:23:47 +0000 (10:23 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 27 May 2020 15:46:41 +0000 (17:46 +0200)
commit97d817b9ef13e2d52a86ea032b0df6a922e0e9df
tree6efe7ea34dc0f1286c25a411bfbfec4daa10407e
parent3b1e38dfbc9f1bcec35cae89b2d9b498e542f7c8
apparmor: Fix use-after-free in aa_audit_rule_init

commit c54d481d71c6849e044690d3960aaebc730224cc upstream.

In the implementation of aa_audit_rule_init(), when aa_label_parse()
fails the allocated memory for rule is released using
aa_audit_rule_free(). But after this release, the return statement
tries to access the label field of the rule which results in
use-after-free. Before releasing the rule, copy errNo and return it
after release.

Fixes: 52e8c38001d8 ("apparmor: Fix memory leak of rule on error exit path")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
security/apparmor/audit.c