2018-03-27 13:38:28

by Colin King

Subject: [PATCH][next] apparmor: fix memory leak on buffer on error exit path

From: Colin Ian King <[email protected]>

Currently on the error exit path the allocated buffer is not free'd
causing a memory leak. Fix this by kfree'ing it.

Detected by CoverityScan, CID#1466876 ("Resource leaks")

Fixes: 1180b4c757aa ("apparmor: fix dangling symlinks to policy rawdata after replacement")
Signed-off-by: Colin Ian King <[email protected]>
---
security/apparmor/apparmorfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 96bb6b73af65..949dd8a48164 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -1497,8 +1497,10 @@ static char *gen_symlink_name(int depth, const char *dirname, const char *fname)
}

error = snprintf(s, size, "raw_data/%s/%s", dirname, fname);
- if (error >= size || error < 0)
+ if (error >= size || error < 0) {
+ kfree(buffer);
return ERR_PTR(-ENAMETOOLONG);
+ }

return buffer;
}
--
2.15.1

2018-03-31 04:14:49

by John Johansen

Subject: Re: [PATCH][next] apparmor: fix memory leak on buffer on error exit path

On 03/27/2018 06:35 AM, Colin King wrote:
> From: Colin Ian King <[email protected]>
>
> Currently on the error exit path the allocated buffer is not free'd
> causing a memory leak. Fix this by kfree'ing it.
>
> Detected by CoverityScan, CID#1466876 ("Resource leaks")
>
> Fixes: 1180b4c757aa ("apparmor: fix dangling symlinks to policy rawdata after replacement")
> Signed-off-by: Colin Ian King <[email protected]>

thanks Colin

I've pulled it into apparmor-next

> ---
> security/apparmor/apparmorfs.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
> index 96bb6b73af65..949dd8a48164 100644
> --- a/security/apparmor/apparmorfs.c
> +++ b/security/apparmor/apparmorfs.c
> @@ -1497,8 +1497,10 @@ static char *gen_symlink_name(int depth, const char *dirname, const char *fname)
> }
>
> error = snprintf(s, size, "raw_data/%s/%s", dirname, fname);
> - if (error >= size || error < 0)
> + if (error >= size || error < 0) {
> + kfree(buffer);
> return ERR_PTR(-ENAMETOOLONG);
> + }
>
> return buffer;
> }
>