apparmor: free rawdata as soon as possible

profiles can be pinned by file and other references, and can live long
after they have been replaced/removed. The rawdata however is no longer
needed, and can be freed earlier than the rest of the profile.

Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index b6a5eb4021dbde0bfba150814050afa42a7bd1be..1739a9de9893a6546a53da320216babf94205d09 100644 (file)
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -232,6 +232,13 @@ static void __remove_profile(struct aa_profile *profile)
        aa_label_remove(&profile->label);
        __aafs_profile_rmdir(profile);
        __list_remove_profile(profile);
+       /* rawdata is only ever referenced by fs lookup, that is no
+        * longer possible here, so put the reference to it. This will
+        * enable the rawdata to be freed if for some reason the profile
+        * is pinned and going to live for a while.
+        */
+       aa_put_profile_loaddata(profile->rawdata);
+       profile->rawdata = NULL;
 }
 
 /**