From: John Johansen Date: Wed, 10 Sep 2025 13:22:17 +0000 (-0700) Subject: apparmor: Fix double free of ns_name in aa_replace_profiles() X-Git-Tag: v7.0-rc4~38^2~4 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5df0c44e8f5f619d3beb871207aded7c78414502;p=thirdparty%2Fkernel%2Flinux.git apparmor: Fix double free of ns_name in aa_replace_profiles() if ns_name is NULL after 1071 error = aa_unpack(udata, &lh, &ns_name); and if ent->ns_name contains an ns_name in 1089 } else if (ent->ns_name) { then ns_name is assigned the ent->ns_name 1095 ns_name = ent->ns_name; however ent->ns_name is freed at 1262 aa_load_ent_free(ent); and then again when freeing ns_name at 1270 kfree(ns_name); Fix this by NULLing out ent->ns_name after it is transferred to ns_name Fixes: 145a0ef21c8e9 ("apparmor: fix blob compression when ns is forced on a policy load ") Reported-by: Qualys Security Advisory Tested-by: Salvatore Bonaccorso Reviewed-by: Georgia Garcia Reviewed-by: Cengiz Can Signed-off-by: John Johansen --- diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index 566821852592..4476515d97b1 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -1166,6 +1166,7 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label, goto fail; } ns_name = ent->ns_name; + ent->ns_name = NULL; } else count++; }