diff options
| author | Zhengmian Hu <huzhengmian@gmail.com> | 2026-01-19 19:03:07 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-02-26 15:01:34 -0800 |
| commit | 4bcddd0f6b2e52b4c7b520e4d36a115caf5b7169 (patch) | |
| tree | 99c9322ffb3fe7cf44d4a1a912e558c2da1aad90 /security | |
| parent | 4bcdc78b71b03c12b97947d74acf7d37cbeed594 (diff) | |
apparmor: avoid per-cpu hold underflow in aa_get_buffer
[ Upstream commit 640cf2f09575c9dc344b3f7be2498d31e3923ead ]
When aa_get_buffer() pulls from the per-cpu list it unconditionally
decrements cache->hold. If hold reaches 0 while count is still non-zero,
the unsigned decrement wraps to UINT_MAX. This keeps hold non-zero for a
very long time, so aa_put_buffer() never returns buffers to the global
list, which can starve other CPUs and force repeated kmalloc(aa_g_path_max)
allocations.
Guard the decrement so hold never underflows.
Fixes: ea9bae12d028 ("apparmor: cache buffers on percpu list if there is lock contention")
Signed-off-by: Zhengmian Hu <huzhengmian@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/lsm.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 8d5d9a966b71..9175fd677ef3 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -2137,7 +2137,8 @@ char *aa_get_buffer(bool in_atomic) if (!list_empty(&cache->head)) { aa_buf = list_first_entry(&cache->head, union aa_buffer, list); list_del(&aa_buf->list); - cache->hold--; + if (cache->hold) + cache->hold--; cache->count--; put_cpu_ptr(&aa_local_buffers); return &aa_buf->buffer[0]; |