apparmor: fix potential UAF in aa_replace_profiles

The function aa_replace_profiles was accessing udata->size after calling
aa_put_loaddata(udata), causing a potential UAF.

Fixed this by saving the size to a local variable before dropping the
reference.

Fixes: 5ac8c355ae001 ("apparmor: allow introspecting the loaded policy pre internal transform")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 1739a9de9893a6546a53da320216babf94205d09..08620984d9505f646c2a207d97fc717565d13427 100644 (file)
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -1378,13 +1378,15 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
        mutex_unlock(&ns->lock);
 
 out:
+       ssize_t udata_sz = udata->size;
+
        aa_put_ns(ns);
        aa_put_profile_loaddata(udata);
        kfree(ns_name);
 
        if (error)
                return error;
-       return udata->size;
+       return udata_sz;
 
 fail_lock:
        mutex_unlock(&ns->lock);