Re: [PATCH 6.12.y] ipe: fix use-after-free when auditing a newly loaded policy

[Fan Wu <wufan@kernel.org>]

On 9/29/2026 5:46 AM, Sasha Levin wrote:
> From: Fan Wu <wufan@kernel.org>
> 
> [ Upstream commit 9814077275eca36ebf8d510d2f076d235ff9f51a ]
> 
> new_policy() audits the policy after ipe_new_policyfs_node() publishes it
> and drops the new directory's inode lock. A concurrent delete can free
> the policy while ipe_audit_policy_load() is still using it.
> 
> Audit the successful load under that lock.
> 
> Fixes: f44554b5067b ("audit,ipe: add IPE auditing support")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> [FW: remove model name according to latest guideline]
> Signed-off-by: Fan Wu <wufan@kernel.org>
> [ adapted new_policy() changes to the older success-only auditing implementation. ]
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  security/ipe/fs.c        | 4 ----
>  security/ipe/policy_fs.c | 4 ++++
>  2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/security/ipe/fs.c b/security/ipe/fs.c
> index 5b6d19fb844a0..d6f90235d6142 100644
> --- a/security/ipe/fs.c
> +++ b/security/ipe/fs.c
> @@ -155,10 +155,6 @@ static ssize_t new_policy(struct file *f, const char __user *data,
>  	}
>  
>  	rc = ipe_new_policyfs_node(p);
> -	if (rc)
> -		goto out;
> -
> -	ipe_audit_policy_load(p);
>  
>  out:
>  	if (rc < 0)
> diff --git a/security/ipe/policy_fs.c b/security/ipe/policy_fs.c
> index 3bcd8cbd09dff..5eba2bb93276f 100644
> --- a/security/ipe/policy_fs.c
> +++ b/security/ipe/policy_fs.c
> @@ -12,6 +12,7 @@
>  #include "policy.h"
>  #include "eval.h"
>  #include "fs.h"
> +#include "audit.h"
>  
>  #define MAX_VERSION_SIZE ARRAY_SIZE("65535.65535.65535")
>  
> @@ -463,6 +464,9 @@ int ipe_new_policyfs_node(struct ipe_policy *p)
>  	inode_lock(root);
>  	p->policyfs = policyfs;
>  	root->i_private = p;
> +	/* Only audit signed policies from userspace */
> +	if (p->pkcs7)
> +		ipe_audit_policy_load(p);
>  	inode_unlock(root);
>  
>  	return 0;

This looks good to me.

Fan