diff options
| author | Zhengmian Hu <huzhengmian@gmail.com> | 2026-01-19 19:03:07 -0500 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2026-01-29 01:27:55 -0800 |
| commit | 640cf2f09575c9dc344b3f7be2498d31e3923ead (patch) | |
| tree | 78de8b71fc7d0d00938aa2788d13892cef173c1c /security | |
| parent | 796c146fa6c8289afc9e18004c21bfe05c75a487 (diff) | |
apparmor: avoid per-cpu hold underflow in aa_get_buffer
When aa_get_buffer() pulls from the per-cpu list it unconditionally
decrements cache->hold. If hold reaches 0 while count is still non-zero,
the unsigned decrement wraps to UINT_MAX. This keeps hold non-zero for a
very long time, so aa_put_buffer() never returns buffers to the global
list, which can starve other CPUs and force repeated kmalloc(aa_g_path_max)
allocations.
Guard the decrement so hold never underflows.
Fixes: ea9bae12d028 ("apparmor: cache buffers on percpu list if there is lock contention")
Signed-off-by: Zhengmian Hu <huzhengmian@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/lsm.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 8d5d9a966b71..9175fd677ef3 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -2137,7 +2137,8 @@ char *aa_get_buffer(bool in_atomic) if (!list_empty(&cache->head)) { aa_buf = list_first_entry(&cache->head, union aa_buffer, list); list_del(&aa_buf->list); - cache->hold--; + if (cache->hold) + cache->hold--; cache->count--; put_cpu_ptr(&aa_local_buffers); return &aa_buf->buffer[0]; |