On Wed, Aug 19, 2026 at 2:39 AM Maxime Bélair via AppArmor <[email protected]> wrote: > > aa_label_strn_parse() returns -ENOENT for every failure, so a caller > cannot tell "no such profile" from "could not allocate a label". > > Report an allocation failure as -ENOMEM. > > Fixes: f1bd904175e8 ("apparmor: add the base fns() for domain labels") > Signed-off-by: Maxime Bélair <[email protected]> > --- > security/apparmor/label.c | 14 ++++++++++---- > 1 file changed, 10 insertions(+), 4 deletions(-) > > diff --git a/security/apparmor/label.c b/security/apparmor/label.c > index 82742a471055..8970bfc08c04 100644 > --- a/security/apparmor/label.c > +++ b/security/apparmor/label.c > @@ -1955,12 +1955,18 @@ struct aa_label *aa_label_strn_parse(struct aa_label > *base, const char *str, > goto out; > } > > - if (create) > + if (create) { > label = aa_vec_find_or_create_label(vec, len, gfp); > - else > + if (!label) { > + /* not absence: creating only fails on allocation */ > + label = ERR_PTR(-ENOMEM); > + goto out; > + } > + } else { > label = vec_find(vec, len); > - if (!label) > - goto fail; > + if (!label) > + goto fail; > + } > > out: > /* use adjusted len from after vec_unique, not original */ > -- > 2.51.0 > >
Reviewed-by: Ryan Lee <[email protected]>
