diff options
| author | John Johansen <john.johansen@canonical.com> | 2025-11-24 15:07:42 -0800 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2026-03-04 07:19:48 -0500 |
| commit | 68538ec34fcb4194c7961dc4eca6f5537fec8067 (patch) | |
| tree | 7a32fbb82e28560583bbd72e5159f68a9b99130c /security | |
| parent | fd54ddc929be1d6c3b3b7b35d6d4642a5d9e803c (diff) | |
apparmor: fix NULL sock in aa_sock_file_perm
[ Upstream commit 00b67657535dfea56e84d11492f5c0f61d0af297 ]
Deal with the potential that sock and sock-sk can be NULL during
socket setup or teardown. This could lead to an oops. The fix for NULL
pointer dereference in __unix_needs_revalidation shows this is at
least possible for af_unix sockets. While the fix for af_unix sockets
applies for newer mediation this is still the fall back path for older
af_unix mediation and other sockets, so ensure it is covered.
Fixes: 56974a6fcfef6 ("apparmor: add base infastructure for socket mediation")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/net.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/security/apparmor/net.c b/security/apparmor/net.c index fa0e85568450..fbbfedd253f6 100644 --- a/security/apparmor/net.c +++ b/security/apparmor/net.c @@ -182,8 +182,10 @@ int aa_sock_file_perm(struct aa_label *label, const char *op, u32 request, struct socket *sock) { AA_BUG(!label); - AA_BUG(!sock); - AA_BUG(!sock->sk); + + /* sock && sock->sk can be NULL for sockets being set up or torn down */ + if (!sock || !sock->sk) + return 0; return aa_label_sk_perm(label, op, request, sock->sk); } |