apparmor: fix invalid reference to index variable of iterator line 836

Once the loop on lines 836-853 is complete and exits normally, ent is a
pointer to the dummy list head value.  The derefernces accessible from eg
the goto fail on line 860 or the various goto fail_lock's afterwards thus
seem incorrect.

Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index def1fbd6bdfd8185a8ec1c4ebcf102e5699acf09..cf9d670dca945ea01245df03468d0f99a22262fe 100644 (file)
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -876,9 +876,11 @@ ssize_t aa_replace_profiles(struct aa_ns *view, struct aa_profile *profile,
        if (ns_name) {
                ns = aa_prepare_ns(view, ns_name);
                if (IS_ERR(ns)) {
+                       op = OP_PROF_LOAD;
                        info = "failed to prepare namespace";
                        error = PTR_ERR(ns);
                        ns = NULL;
+                       ent = NULL;
                        goto fail;
                }
        } else
@@ -1013,7 +1015,7 @@ fail_lock:
        /* audit cause of failure */
        op = (!ent->old) ? OP_PROF_LOAD : OP_PROF_REPL;
 fail:
-       audit_policy(profile, op, ns_name, ent->new->base.hname,
+       audit_policy(profile, op, ns_name, ent ? ent->new->base.hname : NULL,
                     info, error);
        /* audit status that rest of profiles in the atomic set failed too */
        info = "valid profile in failed atomic policy load";
@@ -1023,7 +1025,7 @@ fail:
                        /* skip entry that caused failure */
                        continue;
                }
-               op = (!ent->old) ? OP_PROF_LOAD : OP_PROF_REPL;
+               op = (!tmp->old) ? OP_PROF_LOAD : OP_PROF_REPL;
                audit_policy(profile, op, ns_name,
                             tmp->new->base.hname, info, error);
        }