Hi, On 2026-09-17 09:15, Maciek Borzecki wrote: > When a confined process performs the first file permission revalidation on > an AF_UNIX socket, both update_sk_ctx() and update_peer_ctx() can be called > before the socket's peer label cache (ctx->peer) has been populated. In > those cases they pass NULL as a label argument to aa_label_is_subset() or > aa_label_merge(), which immediately dereferences label->size and causes an > Oops: > > RIP: __aa_label_next_not_in_set+0xd/0x110 > CR2: 000000000000004c > Call Trace: > aa_label_is_subset > aa_unix_file_perm > aa_file_perm > apparmor_file_permission > security_file_permission > rw_verify_area > vfs_write > ksys_write > > Observed on Arch Linux kernels 7.2.4-arch1-2 and 7.2.6-arch2-1, triggered > by snapd unit tests writing to a connected AF_UNIX socket. The issue > persists across those stable updates. >
It appears to be the same issue as reported here: https://bugs.debian.org/1145111 And a patch that looks similar to yours has already been posted: https://lore.kernel.org/[email protected] As it seems you have looked at the bug in details, you can maybe comment it and add a Tested-by: and/or Reviewed-by:, that might help to make things progress. Regards Aurelien -- Aurelien Jarno GPG: 4096R/1DDD8C9B [email protected] http://aurel32.net
