Commit 640cf2f0 authored by Zhengmian Hu's avatar Zhengmian Hu Committed by John Johansen
Browse files

apparmor: avoid per-cpu hold underflow in aa_get_buffer 



When aa_get_buffer() pulls from the per-cpu list it unconditionally
decrements cache->hold. If hold reaches 0 while count is still non-zero,
the unsigned decrement wraps to UINT_MAX. This keeps hold non-zero for a
very long time, so aa_put_buffer() never returns buffers to the global
list, which can starve other CPUs and force repeated kmalloc(aa_g_path_max)
allocations.

Guard the decrement so hold never underflows.
Fixes: ea9bae12 ("apparmor: cache buffers on percpu list if there is lock contention")

Signed-off-by: default avatarZhengmian Hu <huzhengmian@gmail.com>
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent 796c146f

security/apparmor/lsm.c

+2 −1
Original line number Diff line number Diff line
@@ -2137,6 +2137,7 @@ char *aa_get_buffer(bool in_atomic) 
	if (!list_empty(&cache->head)) {

		aa_buf = list_first_entry(&cache->head, union aa_buffer, list);

		list_del(&aa_buf->list);

		if (cache->hold)

			cache->hold--;

		cache->count--;

		put_cpu_ptr(&aa_local_buffers);