Originally found in 7.0.0 in LTS ubuntu 26.04 with pam_apparmor + su in
complain mode set to change hats.
Then verified in newest available vanilla kernel I've compiled to see if
still present:
7.2-rc7 vanilla -> affected
checked also some other kernels:
6.18.44 vanilla -> affected
6.12.95 with debian patches -> unaffected
Simplified reproduction that does not need complex pam_apparmor config:
hat.c
#include <sys/apparmor.h>
#include <stdio.h>
int main(void) {
int rc = aa_change_hat("no_such_hat", 0x1234abcdUL);
printf("aa_change_hat rc=%d\n", rc);
return 0;
}
cc -o /usr/local/bin/hat hat.c -lapparmor
/etc/apparmor.d/local.hat
abi <abi/4.0>,
include <tunables/global>
# Complain-mode profile with NO matching hat:
profile hattest /usr/local/bin/hat flags=(complain) {
include <abstractions/base>
/usr/local/bin/hat mr,
# deliberately no ^hat defined
}
apparmor_parser -r /etc/apparmor.d/local.hat
Then to trigger the bug:
aa-exec -p hattest -- /usr/local/bin/hat
On systems without bug (for example 6.12.95 debian) it just prints:
aa_change_hat rc=0
On systems with bug, the executable always hangs, prints nothing and
becomes unkillable.
(And once stuck this way, it will cause any further hat changes to also
cause the changing process to get stuck)
Then in syslog you can find hint about cause:
kernel: INFO: task hat:3409 blocked for more than 483 seconds.
kernel: Not tainted 7.2.0-rc7 #1
kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this
message.
kernel: task:hat state:D stack:0 pid:3409 tgid:3409
ppid:2605 task_flags:0x400000 flags:0x00080800
kernel: Call Trace:
kernel: <TASK>
kernel: __schedule+0x48f/0xfe0
kernel: schedule+0x27/0xa0
kernel: schedule_preempt_disabled+0x15/0x30
kernel: __mutex_lock.constprop.0+0x569/0xa10
kernel: aa_new_learning_profile+0x15f/0x210
kernel: build_change_hat+0x19f/0x3b0
kernel: change_hat.isra.0+0x5dd/0xd60
kernel: aa_change_hat+0x2f3/0x710
kernel: aa_setprocattr_changehat+0x121/0x1f0
kernel: do_setattr+0x28c/0x340
kernel: apparmor_setselfattr+0x20/0x50
kernel: security_setselfattr+0xf6/0x110
kernel: __x64_sys_lsm_set_self_attr+0x53/0x90
kernel: do_syscall_64+0xdd/0x5e0
kernel: ? __mod_memcg_lruvec_state+0xfd/0x260
kernel: ? lruvec_stat_mod_folio+0x8d/0xd0
kernel: ? __folio_mod_stat+0x2d/0x90
kernel: ? map_anon_folio_pte_nopf+0xd1/0x1f0
kernel: ? do_anonymous_page+0x184/0xa10
kernel: ? __handle_mm_fault+0x805/0x870
kernel: ? count_memcg_events+0xef/0x230
kernel: ? handle_mm_fault+0x1f0/0x2f0
kernel: ? do_user_addr_fault+0x2bb/0x7b0
kernel: ? do_syscall_64+0x94/0x5e0
kernel: ? exc_page_fault+0x75/0x160
kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
kernel: RIP: 0033:0x7f815e134c8d
kernel: RSP: 002b:00007fff6df94ea8 EFLAGS: 00000246 ORIG_RAX:
00000000000001cc
kernel: RAX: ffffffffffffffda RBX: 0000556d8c81d040 RCX:
00007f815e134c8d
kernel: RDX: 0000000000000046 RSI: 0000556d8c81d040 RDI:
0000000000000064
kernel: RBP: 00007fff6df94ef0 R08: 00007f815e212ac8 R09:
000000000000000c
kernel: R10: 0000000000000000 R11: 0000000000000246 R12:
0000556d8c81d010
kernel: R13: 0000000000000026 R14: 0000000000000046 R15:
0000000000000064
kernel: </TASK>
kernel: INFO: task hat:3409 is blocked on a mutex likely owned by task
hat:3409.
