Re: [PATCH 0/2] apparmor unaligned memory fixes

Helge Deller
2025-11-18T11:09:41Z

Hi Adrian,

* John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>:
> On Sat, 2025-05-31 at 17:08 +0200, deller@kernel.org wrote:
> > From: Helge Deller <deller@gmx.de>
> >
> > Two patches which fix unaligned memory accesses in apparmor.
> > Both triggered on the parisc platform, which is much more
> > memory alignment sensitive and will report violations.
> > Please check and apply.
> >
> > Helge
> >
> > Helge Deller (2):
> > apparmor: Fix 8-byte alignment for initial dfa blob streams
> > apparmor: Fix unaligned memory accesses in KUnit test
> >
> > security/apparmor/lsm.c | 4 ++--
> > security/apparmor/policy_unpack_test.c | 6 ++++--
> > 2 files changed, 6 insertions(+), 4 deletions(-)
>
> Thanks for looking into this!
>
> Unfortunately, the problem still persists on SPARC even with v6.18-rc6:
>
> [ 76.209476] Kernel unaligned access at TPC[8dabfc] aa_dfa_unpack+0x3c/0x6e0
> [ 76.301115] Kernel unaligned access at TPC[8dac0c] aa_dfa_unpack+0x4c/0x6e0
> [ 76.392697] Kernel unaligned access at TPC[8dacf0] aa_dfa_unpack+0x130/0x6e0
> [ 76.485440] Kernel unaligned access at TPC[8dacf0] aa_dfa_unpack+0x130/0x6e0
> [ 76.578179] Kernel unaligned access at TPC[8dacf0] aa_dfa_unpack+0x130/0x6e0
>
> I have documented the problem here [1].
> [1] https://github.com/sparclinux/issues/issues/30
>
> So, I suspect that your fix is incomplete.

My patch fixed two call sites, but I suspect you see another call site which
hasn't been fixed yet.

Can you try attached patch? It might indicate the caller of the function and
maybe prints the struct name/address which isn't aligned.

Helge

diff --git a/security/apparmor/match.c b/security/apparmor/match.c
index c5a91600842a..b477430c07eb 100644
--- a/security/apparmor/match.c
+++ b/security/apparmor/match.c
@@ -313,6 +313,9 @@ struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags)
if (size < sizeof(struct table_set_header))
goto fail;

+ if (WARN_ON(((unsigned long)data) & (BITS_PER_LONG/8 - 1)))
+ pr_warn("dfa blob stream %pS not aligned.\n", data);
+
if (ntohl(*(__be32 *) data) != YYTH_MAGIC)
goto fail;