[apparmor] [PATCH] apparmor: Fix namespace reference leak in __aa_find_or_create_ns()

[Wentao Liang]

When the namespace already exists, the reference taken by aa_get_ns() is
overwritten with ERR_PTR(-EEXIST) without being released. The caller in
apparmorfs.c clears ns on IS_ERR() and so cannot drop it either, leaking
the reference on every mkdir of an existing namespace.

Release the reference before returning -EEXIST.

Fixes: 73688d1ed0b8 ("apparmor: refactor prepare_ns() and make usable from 
different views")
Cc: sta...@vger.kernel.org
Signed-off-by: Wentao Liang <vu...@iscas.ac.cn>
---
 security/apparmor/policy_ns.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c
index 5a907a875d8f..c423f4504d4d 100644
--- a/security/apparmor/policy_ns.c
+++ b/security/apparmor/policy_ns.c
@@ -267,8 +267,10 @@ struct aa_ns *__aa_find_or_create_ns(struct aa_ns *parent, 
const char *name,
        ns = aa_get_ns(__aa_find_ns(&parent->sub_ns, name));
        if (!ns)
                ns = __aa_create_ns(parent, name, dir);
-       else
+       else {
+               aa_put_ns(ns);
                ns = ERR_PTR(-EEXIST);
+       }
 
        /* return ref */
        return ns;
-- 
2.34.1