Commit f41d2ead authored Jan 02, 2025 by Jinjie Ruan Committed by Gu Bowen Jan 02, 2025

apparmor: test: Fix memory leak for aa_unpack_strdup()

stable inclusion
from stable-v6.6.64
commit 2a9b68f2dc6812bd1b8880b5c00e60203d6f61f6
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGGQ
CVE: CVE-2024-56741

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2a9b68f2dc6812bd1b8880b5c00e60203d6f61f6



--------------------------------

commit 7290f59231910ccba427d441a6e8b8c6f6112448 upstream.

The string allocated by kmemdup() in aa_unpack_strdup() is not
freed and cause following memory leaks, free them to fix it.

	unreferenced object 0xffffff80c6af8a50 (size 8):
	  comm "kunit_try_catch", pid 225, jiffies 4294894407
	  hex dump (first 8 bytes):
	    74 65 73 74 69 6e 67 00                          testing.
	  backtrace (crc 5eab668b):
	    [<0000000001e3714d>] kmemleak_alloc+0x34/0x40
	    [<000000006e6c7776>] __kmalloc_node_track_caller_noprof+0x300/0x3e0
	    [<000000006870467c>] kmemdup_noprof+0x34/0x60
	    [<000000001176bb03>] aa_unpack_strdup+0xd0/0x18c
	    [<000000008ecde918>] policy_unpack_test_unpack_strdup_with_null_name+0xf8/0x3ec
	    [<0000000032ef8f77>] kunit_try_run_case+0x13c/0x3ac
	    [<00000000f3edea23>] kunit_generic_run_threadfn_adapter+0x80/0xec
	    [<00000000adf936cf>] kthread+0x2e8/0x374
	    [<0000000041bb1628>] ret_from_fork+0x10/0x20
	unreferenced object 0xffffff80c2a29090 (size 8):
	  comm "kunit_try_catch", pid 227, jiffies 4294894409
	  hex dump (first 8 bytes):
	    74 65 73 74 69 6e 67 00                          testing.
	  backtrace (crc 5eab668b):
	    [<0000000001e3714d>] kmemleak_alloc+0x34/0x40
	    [<000000006e6c7776>] __kmalloc_node_track_caller_noprof+0x300/0x3e0
	    [<000000006870467c>] kmemdup_noprof+0x34/0x60
	    [<000000001176bb03>] aa_unpack_strdup+0xd0/0x18c
	    [<0000000046a45c1a>] policy_unpack_test_unpack_strdup_with_name+0xd0/0x3c4
	    [<0000000032ef8f77>] kunit_try_run_case+0x13c/0x3ac
	    [<00000000f3edea23>] kunit_generic_run_threadfn_adapter+0x80/0xec
	    [<00000000adf936cf>] kthread+0x2e8/0x374
	    [<0000000041bb1628>] ret_from_fork+0x10/0x20

Cc: stable@vger.kernel.org
Fixes: 4d944bcd ("apparmor: add AppArmor KUnit tests for policy unpack")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gu Bowen <gubowen5@huawei.com>

parent c2f1662c

security/apparmor/policy_unpack_test.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -281,6 +281,8 @@ static void policy_unpack_test_unpack_strdup_with_null_name(struct kunit *test)
		((uintptr_t)puf->e->start <= (uintptr_t)string)
		&& ((uintptr_t)string <= (uintptr_t)puf->e->end));
		KUNIT_EXPECT_STREQ(test, string, TEST_STRING_DATA);

		kfree(string);
		}

		static void policy_unpack_test_unpack_strdup_with_name(struct kunit *test)
		@@ -296,6 +298,8 @@ static void policy_unpack_test_unpack_strdup_with_name(struct kunit *test)
		((uintptr_t)puf->e->start <= (uintptr_t)string)
		&& ((uintptr_t)string <= (uintptr_t)puf->e->end));
		KUNIT_EXPECT_STREQ(test, string, TEST_STRING_DATA);

		kfree(string);
		}

		static void policy_unpack_test_unpack_strdup_out_of_bounds(struct kunit *test)
		@@ -313,6 +317,8 @@ static void policy_unpack_test_unpack_strdup_out_of_bounds(struct kunit *test)
		KUNIT_EXPECT_EQ(test, size, 0);
		KUNIT_EXPECT_NULL(test, string);
		KUNIT_EXPECT_PTR_EQ(test, puf->e->pos, start);

		kfree(string);
		}

		static void policy_unpack_test_unpack_nameX_with_null_name(struct kunit *test)