[apparmor] [PATCH 25/43] apparmor: use free_profile instead of put_profile when erroring out early

[John Johansen]

aa_put_profile causes profiles to go throw an rcu based delayed free
cycle.  Discard profiles that can't be in use and hence don't need the delayed
free call free_profile directly.

Signed-off-by: John Johansen <john.johansen at canonical.com>
---
 security/apparmor/include/policy.h |    1 +
 security/apparmor/policy.c         |   12 ++++++------
 security/apparmor/policy_unpack.c  |    6 +++---
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index 909dd9f..3166550 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -227,6 +227,7 @@ struct aa_namespace *aa_find_namespace(struct aa_namespace *root,
 void aa_free_replacedby_kref(struct kref *kref);
 struct aa_profile *aa_alloc_profile(const char *name);
 struct aa_profile *aa_new_null_profile(struct aa_profile *parent, int hat);
+void aa_free_profile(struct aa_profile *profile);
 void aa_free_profile_kref(struct kref *kref);
 struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name);
 struct aa_profile *aa_lookup_profile(struct aa_namespace *ns, const char *name);
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index f55b058..9b621f0 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -307,7 +307,7 @@ fail_ns:
 	return NULL;
 }
 
-static void free_profile(struct aa_profile *profile);
+void aa_free_profile(struct aa_profile *profile);
 /**
  * free_namespace - free a profile namespace
  * @ns: the namespace to free  (MAYBE NULL)
@@ -324,7 +324,7 @@ static void free_namespace(struct aa_namespace *ns)
 	aa_put_namespace(ns->parent);
 
 	ns->unconfined->ns = NULL;
-	free_profile(ns->unconfined);
+	aa_free_profile(ns->unconfined);
 	kzfree(ns);
 }
 
@@ -605,7 +605,7 @@ void aa_free_replacedby_kref(struct kref *kref)
 }
 
 /**
- * free_profile - free a profile
+ * aa_free_profile - free a profile
  * @profile: the profile to free  (MAYBE NULL)
  *
  * Free a profile, its hats and null_profile. All references to the profile,
@@ -614,7 +614,7 @@ void aa_free_replacedby_kref(struct kref *kref)
  * If the profile was referenced from a task context, free_profile() will
  * be called from an rcu callback routine, so we must not sleep here.
  */
-static void free_profile(struct aa_profile *profile)
+void aa_free_profile(struct aa_profile *profile)
 {
 	AA_DEBUG("%s(%p)\n", __func__, profile);
 
@@ -656,7 +656,7 @@ static void aa_free_profile_rcu(struct rcu_head *head)
 	if (p->flags & PFLAG_NS_COUNT)
 		free_namespace(p->ns);
 	else
-		free_profile(p);
+		aa_free_profile(p);
 }
 
 /**
@@ -1127,7 +1127,7 @@ fail:
 	list_for_each_entry_safe(new, tmp, &lh, base.list) {
 		/* &lh list is private and not rcu based */
 		list_del_init(&new->base.list);
-		aa_put_profile(new);
+		aa_free_profile(new);
 	}
 
 	goto out;
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index ef85d43..e6e74f4 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -615,7 +615,7 @@ fail:
 	else if (!name)
 		name = "unknown";
 	audit_iface(profile, name, "failed to unpack profile", e, error);
-	aa_put_profile(profile);
+	aa_free_profile(profile);
 
 	return ERR_PTR(error);
 }
@@ -744,7 +744,7 @@ int aa_unpack(void *udata, size_t size, struct list_head *lh, const char **ns)
 
 		error = verify_profile(profile);
 		if (error) {
-			aa_put_profile(profile);
+			aa_free_profile(profile);
 			goto fail;
 		}
 
@@ -762,7 +762,7 @@ fail:
 	 */
 	list_for_each_entry_safe(profile, tmp, lh, base.list) {
 			list_del_init(&profile->base.list);
-			aa_put_profile(profile);
+			aa_free_profile(profile);
 	}
 
 	return error;
-- 
1.7.10.4