[apparmor] [PATCH] apparmor: fail policy unpack on accept2 allocation failure

[Zygmunt Krynicki]

unpack_pdb() may need to allocate a missing ACCEPT2 table for older policy
data. If that allocation failed, it set an error message but jumped to the
success path, returning a policydb with the required table missing.

Return -ENOMEM through the normal failure path when the ACCEPT2 allocation
fails. Remove the now-unused out label.

Fixes: 2e12c5f06017 ("apparmor: add additional flags to extended permission.")

Signed-off-by: Zygmunt Krynicki <m...@zygoon.pl>
---
 security/apparmor/policy_unpack.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/security/apparmor/policy_unpack.c 
b/security/apparmor/policy_unpack.c
index 9f45d5513d2ca..9084d3d0cffdc 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -1054,7 +1054,8 @@ static int unpack_pdb(struct aa_ext *e, struct 
aa_policydb **policy,
                pdb->dfa->tables[YYTD_ID_ACCEPT2] = kvzalloc(tsize, GFP_KERNEL);
                if (!pdb->dfa->tables[YYTD_ID_ACCEPT2]) {
                        *info = "failed to alloc dfa flags table";
-                       goto out;
+                       error = -ENOMEM;
+                       goto fail;
                }
                pdb->dfa->tables[YYTD_ID_ACCEPT2]->td_lolen = noents;
                pdb->dfa->tables[YYTD_ID_ACCEPT2]->td_flags = tdflags;
@@ -1079,7 +1080,6 @@ static int unpack_pdb(struct aa_ext *e, struct 
aa_policydb **policy,
         * - move free of unneeded trans table here, has to be done
         *   after perm mapping.
         */
-out:
        *policy = pdb;
        return 0;
 
-- 
2.53.0