tree 95c4b0be6317c2bde9f8e5831fc1dc322dd87369
parent 90389f4f54e8c383fff8ea9f5dc8140731426738
author Navid Emamdoost <navid.emamdoost@gmail.com> 1571671427 -0500
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1590593857 +0200

apparmor: Fix use-after-free in aa_audit_rule_init

commit c54d481d71c6849e044690d3960aaebc730224cc upstream.

In the implementation of aa_audit_rule_init(), when aa_label_parse()
fails the allocated memory for rule is released using
aa_audit_rule_free(). But after this release, the return statement
tries to access the label field of the rule which results in
use-after-free. Before releasing the rule, copy errNo and return it
after release.

Fixes: 52e8c38001d8 ("apparmor: Fix memory leak of rule on error exit path")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>