Re: [PATCH] apparmor: hold candidate profile reference during attachment lookup

[sashiko-bot@kernel.org]

> find_attach() retains the best matching profile in candidate while walking
> the profile list under RCU.  When matching xattrs, it pins only the current
> profile and drops the RCU read lock around aa_xattrs_match().  A concurrent
> policy removal can therefore free an earlier candidate during this window.
> If the policy revision changes, the retry also preserves candidate and its
> ranking state because they are initialized above the restart label.  The
> final aa_get_newest_profile() then dereferences the freed profile.
> 
> The reproducer triggers:
> 
>   BUG: KASAN: slab-use-after-free in aa_get_newest_label
>   Read of size 8 by task poc
>   Call Trace:
>    aa_get_newest_label security/apparmor/include/label.h:413
>    find_attach security/apparmor/domain.c:505
> [ ... ]
> Fixes: 8c62ed27a12c ("apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock")
> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
> Closes: https://lore.kernel.org/linux-security-module/20261105164839.66760-1-shuangpeng.kernel@gmail.com/
> Cc: stable@vger.kernel.org
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107183514.1575928-2-bestswngs@gmail.com?part=1