[PATCH] apparmor: Fix namespace reference leak in __aa_find_or_create_ns()

[PATCH] apparmor: Fix namespace reference leak in __aa_find_or_create_ns()

[Wentao Liang]

When the namespace already exists, the reference taken by aa_get_ns() is
overwritten with ERR_PTR(-EEXIST) without being released. The caller in
apparmorfs.c clears ns on IS_ERR() and so cannot drop it either, leaking
the reference on every mkdir of an existing namespace.

Release the reference before returning -EEXIST.

Fixes: 73688d1ed0b8 ("apparmor: refactor prepare_ns() and make usable from different views")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 security/apparmor/policy_ns.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c
index 5a907a875d8f..c423f4504d4d 100644
--- a/security/apparmor/policy_ns.c
+++ b/security/apparmor/policy_ns.c
@@ -267,8 +267,10 @@ struct aa_ns *__aa_find_or_create_ns(struct aa_ns *parent, const char *name,
 	ns = aa_get_ns(__aa_find_ns(&parent->sub_ns, name));
 	if (!ns)
 		ns = __aa_create_ns(parent, name, dir);
-	else
+	else {
+		aa_put_ns(ns);
 		ns = ERR_PTR(-EEXIST);
+	}
 
 	/* return ref */
 	return ns;
-- 
2.34.1

Re: [PATCH] apparmor: Fix namespace reference leak in __aa_find_or_create_ns()

[John Johansen]

On 9/17/26 09:43, Wentao Liang wrote:
> When the namespace already exists, the reference taken by aa_get_ns() is
> overwritten with ERR_PTR(-EEXIST) without being released. The caller in
> apparmorfs.c clears ns on IS_ERR() and so cannot drop it either, leaking
> the reference on every mkdir of an existing namespace.
> 
> Release the reference before returning -EEXIST.
> 
> Fixes: 73688d1ed0b8 ("apparmor: refactor prepare_ns() and make usable from different views")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Acked-by: John Johansen <john.johansen@canonical.com>

I have been pulled this into the apparmor tree

> ---
>   security/apparmor/policy_ns.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c
> index 5a907a875d8f..c423f4504d4d 100644
> --- a/security/apparmor/policy_ns.c
> +++ b/security/apparmor/policy_ns.c
> @@ -267,8 +267,10 @@ struct aa_ns *__aa_find_or_create_ns(struct aa_ns *parent, const char *name,
>   	ns = aa_get_ns(__aa_find_ns(&parent->sub_ns, name));
>   	if (!ns)
>   		ns = __aa_create_ns(parent, name, dir);
> -	else
> +	else {
> +		aa_put_ns(ns);
>   		ns = ERR_PTR(-EEXIST);
> +	}
>   
>   	/* return ref */
>   	return ns;