From f7bd6285ffeb425793334f6d48ccb5035cab2fa7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maxime=20B=C3=A9lair?= Date: Wed, 19 Aug 2026 14:19:44 +0100 Subject: [PATCH] apparmor: fix a leak on a rejected string table entry MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit unpack_strs_table() stores each entry into the table only after validating it, so an entry the validation rejects is never freed. Up to 64KB leaks per rejected entry. Store the pointer before validating it. Fixes: c140dcd1246b ("apparmor: make str table more generic and be able to have multiple entries") Reviewed-by: Ryan Lee Signed-off-by: Maxime Bélair Signed-off-by: John Johansen --- security/apparmor/policy_unpack.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index f1fc48e72d0e..99bc4f946d15 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -558,6 +558,9 @@ static int unpack_strs_table(struct aa_ext *e, const char *name, bool multi, /* aa_unpack_strdup verifies that the last character is * null termination byte. */ + /* publish before validating; the error path frees it */ + table[i].strs = str; + table[i].size = size2; c = process_strs_entry(str, size2, multi); if (c <= 0) { AA_DEBUG(DEBUG_UNPACK, "process_strs %d i %d pos %ld", @@ -570,9 +573,7 @@ static int unpack_strs_table(struct aa_ext *e, const char *name, bool multi, /* fail - all other cases with embedded \0 */ goto fail; } - table[i].strs = str; table[i].count = c; - table[i].size = size2; } if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL)) goto fail;