On Wed, 2026-10-21 at 06:38 -0700, John Johansen wrote:
> On 10/14/26 15:08, Georgia Garcia wrote:
> > labels_profile() is a macro that evaluates its argument twice:
> >
> > #define labels_profile(X) ((X)->vec[(X)->size - 1])
> >
> > aa_get_newest_profile() passes it aa_get_newest_label(&p->label), so
> > every call takes two references on the newest label while callers
> > only put one.
> >
> > Evaluate aa_get_newest_label() once and pass the result to
> > labels_profile().
> >
> > Fixes: 637f688dc3dc ("apparmor: switch from profiles to using labels on
> > contexts")
> > Signed-off-by: Georgia Garcia <[email protected]>
>
> georgia can you rework this so instead of fixing the underlying issue
> just here, we fix it everywhere by converting labels_profile into
> an inline fn.
sure, I'll send a v2
>
> > ---
> > security/apparmor/include/policy.h | 5 ++++-
> > 1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/security/apparmor/include/policy.h
> > b/security/apparmor/include/policy.h
> > index 0dcbf8cf1029..123814baea7b 100644
> > --- a/security/apparmor/include/policy.h
> > +++ b/security/apparmor/include/policy.h
> > @@ -325,7 +325,10 @@ void __aa_profile_list_release(struct list_head *head);
> > */
> > static inline struct aa_profile *aa_get_newest_profile(struct aa_profile
> > *p)
> > {
> > - return labels_profile(aa_get_newest_label(&p->label));
> > + /* labels_profile() evaluates its argument twice */
> > + struct aa_label *newest = aa_get_newest_label(&p->label);
> > +
> > + return labels_profile(newest);
> > }
> >
> > static inline aa_state_t RULE_MEDIATES(struct aa_ruleset *rules,
>
