On 10/14/26 15:08, Georgia Garcia wrote:
labels_profile() is a macro that evaluates its argument twice:
#define labels_profile(X) ((X)->vec[(X)->size - 1])
aa_get_newest_profile() passes it aa_get_newest_label(&p->label), so
every call takes two references on the newest label while callers
only put one.
Evaluate aa_get_newest_label() once and pass the result to
labels_profile().
Fixes: 637f688dc3dc ("apparmor: switch from profiles to using labels on
contexts")
Signed-off-by: Georgia Garcia <[email protected]>
georgia can you rework this so instead of fixing the underlying issue
just here, we fix it everywhere by converting labels_profile into
an inline fn.
---
security/apparmor/include/policy.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/security/apparmor/include/policy.h
b/security/apparmor/include/policy.h
index 0dcbf8cf1029..123814baea7b 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -325,7 +325,10 @@ void __aa_profile_list_release(struct list_head *head);
*/
static inline struct aa_profile *aa_get_newest_profile(struct aa_profile *p)
{
- return labels_profile(aa_get_newest_label(&p->label));
+ /* labels_profile() evaluates its argument twice */
+ struct aa_label *newest = aa_get_newest_label(&p->label);
+
+ return labels_profile(newest);
}
static inline aa_state_t RULE_MEDIATES(struct aa_ruleset *rules,
