From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Quanfa Fu <quanfafu@gmail.com>,
"Tyler Hicks (Microsoft)" <code@tyhicks.com>,
John Johansen <john.johansen@canonical.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.1.y 1/2] apparmor: make aa_set_current_onexec return void
Date: Thu, 3 Sep 2026 11:00:33 -0400 [thread overview]
Message-ID: <20260903150034.855351-1-sashal@kernel.org> (raw)
In-Reply-To: <2026090359-cork-overheat-9dda@gregkh>
From: Quanfa Fu <quanfafu@gmail.com>
[ Upstream commit 0897fcb1c1e7316375166e0a665237bce2391a09 ]
Change the return type to void since it always return 0, and no need
to do the checking in aa_set_current_onexec.
Signed-off-by: Quanfa Fu <quanfafu@gmail.com>
Reviewed-by: "Tyler Hicks (Microsoft)" <code@tyhicks.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Stable-dep-of: 3f4ae5fab613 ("apparmor: fix cred UAF caused by begin_current_label_crit_section()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/domain.c | 2 +-
security/apparmor/include/task.h | 2 +-
security/apparmor/task.c | 5 +----
3 files changed, 3 insertions(+), 6 deletions(-)
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index a6308d103f764..52e16e75e63fa 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -1463,7 +1463,7 @@ int aa_change_profile(const char *fqname, int flags)
}
/* full transition will be built in exec path */
- error = aa_set_current_onexec(target, stack);
+ aa_set_current_onexec(target, stack);
}
goto audit;
diff --git a/security/apparmor/include/task.h b/security/apparmor/include/task.h
index 13437d62c70f4..01717fe432c3b 100644
--- a/security/apparmor/include/task.h
+++ b/security/apparmor/include/task.h
@@ -30,7 +30,7 @@ struct aa_task_ctx {
};
int aa_replace_current_label(struct aa_label *label);
-int aa_set_current_onexec(struct aa_label *label, bool stack);
+void aa_set_current_onexec(struct aa_label *label, bool stack);
int aa_set_current_hat(struct aa_label *label, u64 token);
int aa_restore_previous_label(u64 cookie);
struct aa_label *aa_get_task_label(struct task_struct *task);
diff --git a/security/apparmor/task.c b/security/apparmor/task.c
index 503dc0877fb1a..cd9d43a277314 100644
--- a/security/apparmor/task.c
+++ b/security/apparmor/task.c
@@ -93,9 +93,8 @@ int aa_replace_current_label(struct aa_label *label)
* aa_set_current_onexec - set the tasks change_profile to happen onexec
* @label: system label to set at exec (MAYBE NULL to clear value)
* @stack: whether stacking should be done
- * Returns: 0 or error on failure
*/
-int aa_set_current_onexec(struct aa_label *label, bool stack)
+void aa_set_current_onexec(struct aa_label *label, bool stack)
{
struct aa_task_ctx *ctx = task_ctx(current);
@@ -103,8 +102,6 @@ int aa_set_current_onexec(struct aa_label *label, bool stack)
aa_put_label(ctx->onexec);
ctx->onexec = label;
ctx->token = stack;
-
- return 0;
}
/**
--
2.53.0
next prev parent reply other threads:[~2026-09-03 15:00 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-03 10:44 FAILED: patch "[PATCH] apparmor: fix cred UAF caused by" failed to apply to 6.1-stable tree gregkh
2026-09-03 15:00 ` Sasha Levin [this message]
2026-09-03 15:00 ` [PATCH 6.1.y 2/2] apparmor: fix cred UAF caused by begin_current_label_crit_section() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260903150034.855351-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=code@tyhicks.com \
--cc=john.johansen@canonical.com \
--cc=quanfafu@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.