Re: [PATCH] apparmor: make unpacked rename and attach strings owned copies

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Sep 03, 2026 at 12:01:38AM +0800, Qihang wrote:
> unpack_profile() stores the optional rename and attach strings using
> aa_unpack_str(), which returns pointers into the policy blob.
> profile->rename is later freed with kfree_sensitive(), causing an
> invalid free of an interior pointer on the failed-unpack path.
> profile->attach.xmatch_str can instead become a dangling pointer when
> the original policy blob is freed after compressed binary policy export.
> Use aa_unpack_strdup() for both strings and free xmatch_str with the
> attachment.
> 
> Fixes: 736ec752d95e9 ("AppArmor: policy routines for loading and unpacking policy")
> Cc: stable@vger.kernel.org
> Signed-off-by: Qihang <q.h.hack.winter@gmail.com>
> ---
>  security/apparmor/policy.c        | 1 +
>  security/apparmor/policy_unpack.c | 7 +++++--
>  2 files changed, 6 insertions(+), 2 deletions(-)

as this, and the other apparmor patch, are now public, please just do
this work on the public apparmor list, no need to get security@k.o
involved anymore.

thanks,

greg k-h