Re: [apparmor] [PATCH] apparmor: aa_label_alloc use aa_label_free on alloc failure

[John Johansen via AppArmor]

On 5/2/26 04:21, Zygmunt Krynicki wrote:

aa_label_alloc() allocates a secid before allocating or taking the label
proxy. If the later proxy step fails, the error path only freed the label
memory, leaking any resources initialized by aa_label_init().

Use aa_label_free() on the failure path so partially initialized labels
release their secid and other label resources before the backing memory is
freed.

Signed-off-by: Zygmunt Krynicki <m...@zygoon.pl>

Acked-by: John Johansen <john.johan...@canonical.com>

---
  security/apparmor/label.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index 3a721fdf18339..c6a96355e8d9e 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -458,7 +458,7 @@ struct aa_label *aa_label_alloc(int size, struct aa_proxy 
*proxy, gfp_t gfp)
        return new;

fail:

-       kfree(new);
+       aa_label_free(new);

return NULL;

  }