diff options
| author | Patrick Steinhardt <ps@pks.im> | 2019-12-11 12:44:08 +0100 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2020-01-02 05:31:40 -0800 |
| commit | 9c95a278ba7ca3ccc111c165cc74cb23c744fc85 (patch) | |
| tree | 4984741bc9bcbe491ce6ec6237e90a435b551a01 /security | |
| parent | fd6988496e79a6a4bdb514a4655d2920209eb85d (diff) | |
apparmor: fix bind mounts aborting with -ENOMEM
With commit df323337e507 ("apparmor: Use a memory pool instead per-CPU
caches, 2019-05-03"), AppArmor code was converted to use memory pools. In
that conversion, a bug snuck into the code that polices bind mounts that
causes all bind mounts to fail with -ENOMEM, as we erroneously error out
if `aa_get_buffer` returns a pointer instead of erroring out when it
does _not_ return a valid pointer.
Fix the issue by correctly checking for valid pointers returned by
`aa_get_buffer` to fix bind mounts with AppArmor.
Fixes: df323337e507 ("apparmor: Use a memory pool instead per-CPU caches")
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/mount.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c index 4ed6688f9d40..e0828ee7a345 100644 --- a/security/apparmor/mount.c +++ b/security/apparmor/mount.c @@ -442,7 +442,7 @@ int aa_bind_mount(struct aa_label *label, const struct path *path, buffer = aa_get_buffer(false); old_buffer = aa_get_buffer(false); error = -ENOMEM; - if (!buffer || old_buffer) + if (!buffer || !old_buffer) goto out; error = fn_for_each_confined(label, profile, |