apparmor: fix NULL pointer dereference in unpack_pdb

pdb->dfa could be NULL if unpack_dfa fails, causing a NULL pointer
dereference.

Fixes: 2e12c5f06017 ("apparmor: add additional flags to extended permission.")
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: Manuel Diewald <manuel.diewald@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 9f45d5513d2ca47cfa1b0fce387f8cb5f2f7dd0b..3643c058d6f8923c71b18f0763efab3d40eb3174 100644 (file)
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -1045,7 +1045,7 @@ static int unpack_pdb(struct aa_ext *e, struct aa_policydb **policy,
        }
 
        /* accept2 is in some cases being allocated, even with perms */
-       if (pdb->perms && !pdb->dfa->tables[YYTD_ID_ACCEPT2]) {
+       if (pdb->dfa && pdb->perms && !pdb->dfa->tables[YYTD_ID_ACCEPT2]) {
                /* add dfa flags table missing in v2 */
                u32 noents = pdb->dfa->tables[YYTD_ID_ACCEPT]->td_lolen;
                u16 tdflags = pdb->dfa->tables[YYTD_ID_ACCEPT]->td_flags;