From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Quanfa Fu <quanfafu@gmail.com>,
"Tyler Hicks (Microsoft)" <code@tyhicks.com>,
John Johansen <john.johansen@canonical.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.1.y 1/2] apparmor: make aa_set_current_onexec return void
Date: Thu, 3 Sep 2026 11:00:33 -0400 [thread overview]
Message-ID: <20260903150034.855351-1-sashal@kernel.org> (raw)
In-Reply-To: <2026090359-cork-overheat-9dda@gregkh>
From: Quanfa Fu <quanfafu@gmail.com>
[ Upstream commit 0897fcb1c1e7316375166e0a665237bce2391a09 ]
Change the return type to void since it always return 0, and no need
to do the checking in aa_set_current_onexec.
Signed-off-by: Quanfa Fu <quanfafu@gmail.com>
Reviewed-by: "Tyler Hicks (Microsoft)" <code@tyhicks.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Stable-dep-of: 3f4ae5fab613 ("apparmor: fix cred UAF caused by begin_current_label_crit_section()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/domain.c | 2 +-
security/apparmor/include/task.h | 2 +-
security/apparmor/task.c | 5 +----
3 files changed, 3 insertions(+), 6 deletions(-)
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index a6308d103f764..52e16e75e63fa 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -1463,7 +1463,7 @@ int aa_change_profile(const char *fqname, int flags)
}
/* full transition will be built in exec path */
- error = aa_set_current_onexec(target, stack);
+ aa_set_current_onexec(target, stack);
}
goto audit;
diff --git a/security/apparmor/include/task.h b/security/apparmor/include/task.h
index 13437d62c70f4..01717fe432c3b 100644
--- a/security/apparmor/include/task.h
+++ b/security/apparmor/include/task.h
@@ -30,7 +30,7 @@ struct aa_task_ctx {
};
int aa_replace_current_label(struct aa_label *label);
-int aa_set_current_onexec(struct aa_label *label, bool stack);
+void aa_set_current_onexec(struct aa_label *label, bool stack);
int aa_set_current_hat(struct aa_label *label, u64 token);
int aa_restore_previous_label(u64 cookie);
struct aa_label *aa_get_task_label(struct task_struct *task);
diff --git a/security/apparmor/task.c b/security/apparmor/task.c
index 503dc0877fb1a..cd9d43a277314 100644
--- a/security/apparmor/task.c
+++ b/security/apparmor/task.c
@@ -93,9 +93,8 @@ int aa_replace_current_label(struct aa_label *label)
* aa_set_current_onexec - set the tasks change_profile to happen onexec
* @label: system label to set at exec (MAYBE NULL to clear value)
* @stack: whether stacking should be done
- * Returns: 0 or error on failure
*/
-int aa_set_current_onexec(struct aa_label *label, bool stack)
+void aa_set_current_onexec(struct aa_label *label, bool stack)
{
struct aa_task_ctx *ctx = task_ctx(current);
@@ -103,8 +102,6 @@ int aa_set_current_onexec(struct aa_label *label, bool stack)
aa_put_label(ctx->onexec);
ctx->onexec = label;
ctx->token = stack;
-
- return 0;
}
/**
--
2.53.0
next prev parent reply other threads:[~2026-09-03 15:00 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-03 10:44 FAILED: patch "[PATCH] apparmor: fix cred UAF caused by" failed to apply to 6.1-stable tree gregkh
2026-09-03 15:00 ` Sasha Levin [this message]
2026-09-03 15:00 ` [PATCH 6.1.y 2/2] apparmor: fix cred UAF caused by begin_current_label_crit_section() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260903150034.855351-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=code@tyhicks.com \
--cc=john.johansen@canonical.com \
--cc=quanfafu@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox