diff options
| author | Arnd Bergmann <arnd@arndb.de> | 2012-11-15 17:27:43 +0100 |
|---|---|---|
| committer | Arnd Bergmann <arnd@arndb.de> | 2012-11-15 17:27:43 +0100 |
| commit | 12480c2e53d355223cf6884ed1f56e6ac9b7c21f (patch) | |
| tree | c244c5b4f265dc38f7658fbe5714ba2c402aef28 /security/apparmor/policy.c | |
| parent | 6c8e94a57c30e31d0807f038b4f98b659fd67776 (diff) | |
| parent | 936407358759adb302df93ab61fa68141897270c (diff) | |
Merge tag 'omap-for-v3.8/fixes-non-critical-v4-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into next/fixes-non-critical
From Tony Lindgren <tony@atomide.com>:
Non critical omap fixes that were not considered urgent
for the -rc cycle.
* tag 'omap-for-v3.8/fixes-non-critical-v4-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: (645 commits)
ARM: OMAP4: PM: fix errata handling when CONFIG_PM=n
ARM: OMAP4: retrigger localtimers after re-enabling gic
ARM: OMAP4460: Workaround for ROM bug because of CA9 r2pX GIC control register change.
ARM: OMAP4: PM: add errata support
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Diffstat (limited to 'security/apparmor/policy.c')
| -rw-r--r-- | security/apparmor/policy.c | 24 |
1 files changed, 23 insertions, 1 deletions
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index cf5fd220309..813200384d9 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -724,6 +724,8 @@ fail: */ static void free_profile(struct aa_profile *profile) { + struct aa_profile *p; + AA_DEBUG("%s(%p)\n", __func__, profile); if (!profile) @@ -751,7 +753,27 @@ static void free_profile(struct aa_profile *profile) aa_put_dfa(profile->xmatch); aa_put_dfa(profile->policy.dfa); - aa_put_profile(profile->replacedby); + /* put the profile reference for replacedby, but not via + * put_profile(kref_put). + * replacedby can form a long chain that can result in cascading + * frees that blows the stack because kref_put makes a nested fn + * call (it looks like recursion, with free_profile calling + * free_profile) for each profile in the chain lp#1056078. + */ + for (p = profile->replacedby; p; ) { + if (atomic_dec_and_test(&p->base.count.refcount)) { + /* no more refs on p, grab its replacedby */ + struct aa_profile *next = p->replacedby; + /* break the chain */ + p->replacedby = NULL; + /* now free p, chain is broken */ + free_profile(p); + + /* follow up with next profile in the chain */ + p = next; + } else + break; + } kzfree(profile); } |