apparmor: fixup secid map conversion to using IDR

The IDR conversion did not handle an error case for when allocating a
mapping fails, and it did not ensure that mappings did not allocate or
use a 0 value, which is used as an invalid secid. Which is used when a
mapping fails.

Fixes: 3ae7eb49a2be ("apparmor: Use an IDR to allocate apparmor secids")
Signed-off-by: John Johansen <john.johansen@canonical.com>

4 files changed, 29 insertions, 8 deletions

diff --git a/security/apparmor/include/secid.h b/security/apparmor/include/secid.h
index 686de8e50a79..dee6fa3b6081 100644
--- a/security/apparmor/include/secid.h
+++ b/security/apparmor/include/secid.h
@@ -28,8 +28,10 @@ int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
 void apparmor_release_secctx(char *secdata, u32 seclen);
 
 
-u32 aa_alloc_secid(struct aa_label *label, gfp_t gfp);
+int aa_alloc_secid(struct aa_label *label, gfp_t gfp);
 void aa_free_secid(u32 secid);
 void aa_secid_update(u32 secid, struct aa_label *label);
 
+void aa_secids_init(void);
+
 #endif /* __AA_SECID_H */
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index a17574df611b..ba11bdf9043a 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -407,8 +407,7 @@ bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
         AA_BUG(!label);
         AA_BUG(size < 1);
 
-        label->secid = aa_alloc_secid(label, gfp);
-        if (label->secid == AA_SECID_INVALID)
+        if (aa_alloc_secid(label, gfp) < 0)
                 return false;
 
         label->size = size;                     /* doesn't include null */
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 10bf36aa477d..e35d12883990 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1547,6 +1547,8 @@ static int __init apparmor_init(void)
                 return 0;
         }
 
+        aa_secids_init();
+
         error = aa_setup_dfa_engine();
         if (error) {
                 AA_ERROR("Unable to setup dfa engine\n");
diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c
index 3ad94b2ffbb2..f2f22d00db18 100644
--- a/security/apparmor/secid.c
+++ b/security/apparmor/secid.c
@@ -33,6 +33,8 @@
  * properly updating/freeing them
  */
 
+#define AA_FIRST_SECID 1
+
 static DEFINE_IDR(aa_secids);
 static DEFINE_SPINLOCK(secid_lock);
 
@@ -120,20 +122,31 @@ void apparmor_release_secctx(char *secdata, u32 seclen)
 
 /**
  * aa_alloc_secid - allocate a new secid for a profile
+ * @label: the label to allocate a secid for
+ * @gfp: memory allocation flags
+ *
+ * Returns: 0 with @label->secid initialized
+ *          <0 returns error with @label->secid set to AA_SECID_INVALID
  */
-u32 aa_alloc_secid(struct aa_label *label, gfp_t gfp)
+int aa_alloc_secid(struct aa_label *label, gfp_t gfp)
 {
         unsigned long flags;
-        u32 secid;
+        int ret;
 
         idr_preload(gfp);
         spin_lock_irqsave(&secid_lock, flags);
-        secid = idr_alloc(&aa_secids, label, 0, 0, GFP_ATOMIC);
-        /* XXX: Can return -ENOMEM */
+        ret = idr_alloc(&aa_secids, label, AA_FIRST_SECID, 0, GFP_ATOMIC);
         spin_unlock_irqrestore(&secid_lock, flags);
         idr_preload_end();
 
-        return secid;
+        if (ret < 0) {
+                label->secid = AA_SECID_INVALID;
+                return ret;
+        }
+
+        AA_BUG(ret == AA_SECID_INVALID);
+        label->secid = ret;
+        return 0;
 }
 
 /**
@@ -148,3 +161,8 @@ void aa_free_secid(u32 secid)
         idr_remove(&aa_secids, secid);
         spin_unlock_irqrestore(&secid_lock, flags);
 }
+
+void aa_secids_init(void)
+{
+        idr_init_base(&aa_secids, AA_FIRST_SECID);
+}