apparmor: ensure WB_HISTORY_SIZE value is a power of 2

[ Upstream commit 6c055e62560b958354625604293652753d82bcae ]

WB_HISTORY_SIZE was defined to be a value not a power of 2, despite a
comment in the declaration of struct match_workbuf stating it is and a
modular arithmetic usage in the inc_wb_pos macro assuming that it is. Bump
WB_HISTORY_SIZE's value up to 32 and add a BUILD_BUG_ON_NOT_POWER_OF_2
line to ensure that any future changes to the value of WB_HISTORY_SIZE
respect this requirement.

Fixes: 136db994852a ("apparmor: increase left match history buffer size")
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/security/apparmor/include/match.h b/security/apparmor/include/match.h
index 8844895905881bad81dbce5e8336df6a3cf05d38..29306ec87fd1ab2816fd072543579e93b462c698 100644 (file)
--- a/security/apparmor/include/match.h
+++ b/security/apparmor/include/match.h
@@ -141,7 +141,8 @@ unsigned int aa_dfa_matchn_until(struct aa_dfa *dfa, unsigned int start,
 
 void aa_dfa_free_kref(struct kref *kref);
 
-#define WB_HISTORY_SIZE 24
+/* This needs to be a power of 2 */
+#define WB_HISTORY_SIZE 32
 struct match_workbuf {
        unsigned int count;
        unsigned int pos;

diff --git a/security/apparmor/match.c b/security/apparmor/match.c
index 3e9e1eaf990ed7a953da87505e76c1123c9a5a11..0e683ee323e3cfb634cdfb18f09206ae41afa676 100644 (file)
--- a/security/apparmor/match.c
+++ b/security/apparmor/match.c
@@ -672,6 +672,7 @@ unsigned int aa_dfa_matchn_until(struct aa_dfa *dfa, unsigned int start,
 
 #define inc_wb_pos(wb)                                         \
 do {                                                           \
+       BUILD_BUG_ON_NOT_POWER_OF_2(WB_HISTORY_SIZE);                   \
        wb->pos = (wb->pos + 1) & (WB_HISTORY_SIZE - 1);                \
        wb->len = (wb->len + 1) & (WB_HISTORY_SIZE - 1);                \
 } while (0)