apparmor: avoid per-cpu hold underflow in aa_get_buffer

When aa_get_buffer() pulls from the per-cpu list it unconditionally
decrements cache->hold. If hold reaches 0 while count is still non-zero,
the unsigned decrement wraps to UINT_MAX. This keeps hold non-zero for a
very long time, so aa_put_buffer() never returns buffers to the global
list, which can starve other CPUs and force repeated kmalloc(aa_g_path_max)
allocations.

Guard the decrement so hold never underflows.
Fixes: ea9bae12d028 ("apparmor: cache buffers on percpu list if there is lock contention")
Signed-off-by: Zhengmian Hu <huzhengmian@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 8d5d9a966b719ef7c2274c13b3b89d4caf41d0fd..9175fd677ef3dbfe512b9433f4188fbf35931131 100644 (file)
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -2137,7 +2137,8 @@ char *aa_get_buffer(bool in_atomic)
        if (!list_empty(&cache->head)) {
                aa_buf = list_first_entry(&cache->head, union aa_buffer, list);
                list_del(&aa_buf->list);
-               cache->hold--;
+               if (cache->hold)
+                       cache->hold--;
                cache->count--;
                put_cpu_ptr(&aa_local_buffers);
                return &aa_buf->buffer[0];