tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

apparmor: avoid per-cpu hold underflow in aa_get_buffer

When aa_get_buffer() pulls from the per-cpu list it unconditionally
decrements cache->hold. If hold reaches 0 while count is still non-zero,
the unsigned decrement wraps to UINT_MAX. This keeps hold non-zero for a
very long time, so aa_put_buffer() never returns buffers to the global
list, which can starve other CPUs and force repeated kmalloc(aa_g_path_max)
allocations.

Guard the decrement so hold never underflows.
Fixes: ea9bae12d028 ("apparmor: cache buffers on percpu list if there is lock contention")

Signed-off-by: Zhengmian Hu <huzhengmian@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

authored by

Zhengmian Hu and committed by
John Johansen 640cf2f0 796c146f

+2 -1
+2 -1
security/apparmor/lsm.c
··· 2137 2137 if (!list_empty(&cache->head)) { 2138 2138 aa_buf = list_first_entry(&cache->head, union aa_buffer, list); 2139 2139 list_del(&aa_buf->list); 2140 - cache->hold--; 2140 + if (cache->hold) 2141 + cache->hold--; 2141 2142 cache->count--; 2142 2143 put_cpu_ptr(&aa_local_buffers); 2143 2144 return &aa_buf->buffer[0];