FAILED: patch "[PATCH] ipe: fix use-after-free when auditing a newly loaded policy" failed to apply to 6.12-stable tree

FAILED: patch "[PATCH] ipe: fix use-after-free when auditing a newly loaded policy" failed to apply to 6.12-stable tree

[gregkh]

The patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x 9814077275eca36ebf8d510d2f076d235ff9f51a
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026092955-retrace-denial-b8a2@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 9814077275eca36ebf8d510d2f076d235ff9f51a Mon Sep 17 00:00:00 2001
From: Fan Wu <wufan@kernel.org>
Date: Tue, 22 Sep 2026 20:13:48 -0700
Subject: [PATCH] ipe: fix use-after-free when auditing a newly loaded policy

new_policy() audits the policy after ipe_new_policyfs_node() publishes it
and drops the new directory's inode lock. A concurrent delete can free
the policy while ipe_audit_policy_load() is still using it.

Audit the successful load under that lock.

Fixes: f44554b5067b ("audit,ipe: add IPE auditing support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
[FW: remove model name according to latest guideline]
Signed-off-by: Fan Wu <wufan@kernel.org>

diff --git a/security/ipe/fs.c b/security/ipe/fs.c
index 076c111c85c8..847a76afb93d 100644
--- a/security/ipe/fs.c
+++ b/security/ipe/fs.c
@@ -159,18 +159,16 @@ static ssize_t new_policy(struct file *f, const char __user *data,
 	}
 
 	rc = ipe_new_policyfs_node(p);
-	if (rc)
-		goto out;
 
 out:
 	kfree(copy);
 	if (rc < 0) {
 		ipe_free_policy(p);
 		ipe_audit_policy_load(ERR_PTR(rc));
-	} else {
-		ipe_audit_policy_load(p);
+		return rc;
 	}
-	return (rc < 0) ? rc : len;
+
+	return len;
 }
 
 static const struct file_operations np_fops = {
diff --git a/security/ipe/policy_fs.c b/security/ipe/policy_fs.c
index 9d92d8a14b13..a7aeb57483c6 100644
--- a/security/ipe/policy_fs.c
+++ b/security/ipe/policy_fs.c
@@ -481,6 +481,9 @@ int ipe_new_policyfs_node(struct ipe_policy *p)
 	inode_lock(root);
 	p->policyfs = policyfs;
 	root->i_private = p;
+	/* Only audit signed policies from userspace */
+	if (p->pkcs7)
+		ipe_audit_policy_load(p);
 	inode_unlock(root);
 
 	return 0;

[PATCH 6.12.y] ipe: fix use-after-free when auditing a newly loaded policy

[Sasha Levin]

From: Fan Wu <wufan@kernel.org>

[ Upstream commit 9814077275eca36ebf8d510d2f076d235ff9f51a ]

new_policy() audits the policy after ipe_new_policyfs_node() publishes it
and drops the new directory's inode lock. A concurrent delete can free
the policy while ipe_audit_policy_load() is still using it.

Audit the successful load under that lock.

Fixes: f44554b5067b ("audit,ipe: add IPE auditing support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
[FW: remove model name according to latest guideline]
Signed-off-by: Fan Wu <wufan@kernel.org>
[ adapted new_policy() changes to the older success-only auditing implementation. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/ipe/fs.c        | 4 ----
 security/ipe/policy_fs.c | 4 ++++
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/security/ipe/fs.c b/security/ipe/fs.c
index 5b6d19fb844a0..d6f90235d6142 100644
--- a/security/ipe/fs.c
+++ b/security/ipe/fs.c
@@ -155,10 +155,6 @@ static ssize_t new_policy(struct file *f, const char __user *data,
 	}
 
 	rc = ipe_new_policyfs_node(p);
-	if (rc)
-		goto out;
-
-	ipe_audit_policy_load(p);
 
 out:
 	if (rc < 0)
diff --git a/security/ipe/policy_fs.c b/security/ipe/policy_fs.c
index 3bcd8cbd09dff..5eba2bb93276f 100644
--- a/security/ipe/policy_fs.c
+++ b/security/ipe/policy_fs.c
@@ -12,6 +12,7 @@
 #include "policy.h"
 #include "eval.h"
 #include "fs.h"
+#include "audit.h"
 
 #define MAX_VERSION_SIZE ARRAY_SIZE("65535.65535.65535")
 
@@ -463,6 +464,9 @@ int ipe_new_policyfs_node(struct ipe_policy *p)
 	inode_lock(root);
 	p->policyfs = policyfs;
 	root->i_private = p;
+	/* Only audit signed policies from userspace */
+	if (p->pkcs7)
+		ipe_audit_policy_load(p);
 	inode_unlock(root);
 
 	return 0;
-- 
2.53.0

Re: [PATCH 6.12.y] ipe: fix use-after-free when auditing a newly loaded policy

[Fan Wu]

On 9/29/2026 5:46 AM, Sasha Levin wrote:
> From: Fan Wu <wufan@kernel.org>
> 
> [ Upstream commit 9814077275eca36ebf8d510d2f076d235ff9f51a ]
> 
> new_policy() audits the policy after ipe_new_policyfs_node() publishes it
> and drops the new directory's inode lock. A concurrent delete can free
> the policy while ipe_audit_policy_load() is still using it.
> 
> Audit the successful load under that lock.
> 
> Fixes: f44554b5067b ("audit,ipe: add IPE auditing support")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> [FW: remove model name according to latest guideline]
> Signed-off-by: Fan Wu <wufan@kernel.org>
> [ adapted new_policy() changes to the older success-only auditing implementation. ]
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  security/ipe/fs.c        | 4 ----
>  security/ipe/policy_fs.c | 4 ++++
>  2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/security/ipe/fs.c b/security/ipe/fs.c
> index 5b6d19fb844a0..d6f90235d6142 100644
> --- a/security/ipe/fs.c
> +++ b/security/ipe/fs.c
> @@ -155,10 +155,6 @@ static ssize_t new_policy(struct file *f, const char __user *data,
>  	}
>  
>  	rc = ipe_new_policyfs_node(p);
> -	if (rc)
> -		goto out;
> -
> -	ipe_audit_policy_load(p);
>  
>  out:
>  	if (rc < 0)
> diff --git a/security/ipe/policy_fs.c b/security/ipe/policy_fs.c
> index 3bcd8cbd09dff..5eba2bb93276f 100644
> --- a/security/ipe/policy_fs.c
> +++ b/security/ipe/policy_fs.c
> @@ -12,6 +12,7 @@
>  #include "policy.h"
>  #include "eval.h"
>  #include "fs.h"
> +#include "audit.h"
>  
>  #define MAX_VERSION_SIZE ARRAY_SIZE("65535.65535.65535")
>  
> @@ -463,6 +464,9 @@ int ipe_new_policyfs_node(struct ipe_policy *p)
>  	inode_lock(root);
>  	p->policyfs = policyfs;
>  	root->i_private = p;
> +	/* Only audit signed policies from userspace */
> +	if (p->pkcs7)
> +		ipe_audit_policy_load(p);
>  	inode_unlock(root);
>  
>  	return 0;

This looks good to me.

Fan