Re: [PATCH] apparmor: Fix namespace reference leak in __aa_find_or_create_ns()

[John Johansen]

On 9/17/26 09:43, Wentao Liang wrote:
> When the namespace already exists, the reference taken by aa_get_ns() is
> overwritten with ERR_PTR(-EEXIST) without being released. The caller in
> apparmorfs.c clears ns on IS_ERR() and so cannot drop it either, leaking
> the reference on every mkdir of an existing namespace.
>
> Release the reference before returning -EEXIST.
>
> Fixes: 73688d1ed0b8 ("apparmor: refactor prepare_ns() and make usable from different views")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>

Acked-by: John Johansen <john.johansen@xxxxxxxxxxxxx>

I have been pulled this into the apparmor tree

> ---
>   security/apparmor/policy_ns.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c
> index 5a907a875d8f..c423f4504d4d 100644
> --- a/security/apparmor/policy_ns.c
> +++ b/security/apparmor/policy_ns.c
> @@ -267,8 +267,10 @@ struct aa_ns *__aa_find_or_create_ns(struct aa_ns *parent, const char *name,
>   	ns = aa_get_ns(__aa_find_ns(&parent->sub_ns, name));
>   	if (!ns)
>   		ns = __aa_create_ns(parent, name, dir);
> -	else
> +	else {
> +		aa_put_ns(ns);
>   		ns = ERR_PTR(-EEXIST);
> +	}
>   
>   	/* return ref */
>   	return ns;