apparmor: fail policy unpack on accept2 allocation failure

unpack_pdb() may need to allocate a missing ACCEPT2 table for older policy
data. If that allocation failed, it set an error message but jumped to the
success path, returning a policydb with the required table missing.

Return -ENOMEM through the normal failure path when the ACCEPT2 allocation
fails. Remove the now-unused out label.

Fixes: 2e12c5f06017 ("apparmor: add additional flags to extended permission.")
Reviewed-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 3643c058d6f8923c71b18f0763efab3d40eb3174..d9dcff167c4801a66057d344f322528fcac578dc 100644 (file)
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -1054,7 +1054,8 @@ static int unpack_pdb(struct aa_ext *e, struct aa_policydb **policy,
                pdb->dfa->tables[YYTD_ID_ACCEPT2] = kvzalloc(tsize, GFP_KERNEL);
                if (!pdb->dfa->tables[YYTD_ID_ACCEPT2]) {
                        *info = "failed to alloc dfa flags table";
-                       goto out;
+                       error = -ENOMEM;
+                       goto fail;
                }
                pdb->dfa->tables[YYTD_ID_ACCEPT2]->td_lolen = noents;
                pdb->dfa->tables[YYTD_ID_ACCEPT2]->td_flags = tdflags;
@@ -1079,7 +1080,6 @@ static int unpack_pdb(struct aa_ext *e, struct aa_policydb **policy,
         * - move free of unneeded trans table here, has to be done
         *   after perm mapping.
         */
-out:
        *policy = pdb;
        return 0;