7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Li RongQing [ Upstream commit 7ccd884a5e5386f4c7d98625113f4924f70286b4 ] When unpacking a DFA, aa_dfa_unpack() stores a table in dfa->tables before attempting to remap a 16-bit table to 32-bit. However, remap_data16_to_data32() frees the original table when allocation of the new table fails. This leaves the corresponding dfa->tables entry pointing to freed memory. If the unpacking then fails, dfa_free() attempts to free the same table again. Only publish the table to dfa->tables after any required remapping has completed successfully, so that dfa->tables never contains a pointer to a table that has already been freed. Fixes: 9208c05f9fdf ("apparmor: add support for 2^24 states to the dfa state machine.") Cc: stable@vger.kernel.org Signed-off-by: Li RongQing Signed-off-by: John Johansen Signed-off-by: Sasha Levin --- security/apparmor/match.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/security/apparmor/match.c b/security/apparmor/match.c index 7713484f6a36e..ca30a4292c422 100644 --- a/security/apparmor/match.c +++ b/security/apparmor/match.c @@ -397,7 +397,6 @@ struct aa_dfa *aa_dfa_unpack(const void *blob, size_t size, int flags) /* check for duplicate table entry */ if (dfa->tables[table->td_id]) goto fail; - dfa->tables[table->td_id] = table; data += table_size(table->td_lolen, table->td_flags); size -= table_size(table->td_lolen, table->td_flags); @@ -414,9 +413,9 @@ struct aa_dfa *aa_dfa_unpack(const void *blob, size_t size, int flags) if (!table) goto fail; } - dfa->tables[table->td_id] = table; break; } + dfa->tables[table->td_id] = table; table = NULL; } error = verify_table_headers(dfa->tables, flags); -- 2.53.0