On Fri, 25 Sep 2026 23:41:35 +0200 Salvatore Bonaccorso <[email protected]> wrote: > Hi Maxime, > > On Mon, Aug 31, 2026 at 10:25:07PM +0200, Aurelien Jarno wrote: > > Hi, > > > > On 2026-08-24 23:32, Aurelien Jarno wrote: > > > Hi Maxime, > > > > > > On 2026-08-24 17:58, Maxime Bélair wrote: > > > > aa_unix_file_perm lazily refreshes the AppArmor context cached on a unix > > > > socket. Two of the helpers it uses assume ctx->peer has already been > > > > set: > > > > > > > > update_peer_ctx -> l = aa_label_merge(old, label, GFP_ATOMIC); > > > > update_sk_ctx -> } else if (aa_label_is_subset(plabel, old)) > > > > { > > > > > > > > where @old is ctx->peer. Neither aa_label_merge nor aa_label_is_subset > > > > allows NULL. So both fault on the aa_label->size load. > > > > > > > > BUG: kernel NULL pointer dereference, address: 000000000000004c > > > > RIP: 0010:__aa_label_next_not_in_set+0xb/0xd0 > > > > Call Trace: > > > > aa_label_is_subset+0x3f/0x70 > > > > aa_unix_file_perm+0x5e8/0x9d0 > > > > aa_file_perm+0x45a/0x550 > > > > apparmor_file_permission+0x44/0xb0 > > > > security_file_permission+0x40/0x100 > > > > rw_verify_area+0x56/0x180 > > > > vfs_write+0x7c/0x480 > > > > ksys_write+0xbf/0xf0 > > > > > > > > ctx->peer is only recorded for stream connections and socket pairs. > > > > unix_dgram_connect sets unix_peer(sk) without going through that path, > > > > so a connected AF_UNIX datagram socket has unix_peer(sk) set while > > > > ctx->peer is still NULL, and the first write that needs revalidation > > > > reaches the helpers above. > > > > > > > > Both derefs date back to the Fixes: commit, but the update_sk_ctx() one > > > > was dormant until commit 4483efe4f215 ("apparmor: fix shadowing of > > > > plabel > > > > that prevents cache from being updated") stopped @plabel being shadowed, > > > > which is why bisecting the oops lands there. > > > > > > > > A NULL @old just means no peer label has been recorded yet, so install > > > > the label directly instead of merging or comparing against it. > > > > > > > > Fixes: 88fec3526e84 ("apparmor: make sure unix socket labeling is > > > > correctly updated.") > > > > Reported-by: Aurelien Jarno <[email protected]> > > > > Closes: https://bugs.debian.org/1145111 > > > > Cc: [email protected] > > > > Signed-off-by: Maxime Bélair <[email protected]> > > > > --- > > > > security/apparmor/af_unix.c | 20 ++++++++++++-------- > > > > 1 file changed, 12 insertions(+), 8 deletions(-) > > > > > > Thanks a lot for the quick patch. I confirm it fixes the issue I > > > reported. > > > > > > Tested-by: Aurelien Jarno <[email protected]> > > > > Any news about this patch? The kernel oops can be triggered as a simple > > user, so it would be nice to get it fixed relatively soon.
to leave a record here as well - this triggered on three recent builds of rustc: https://buildd.debian.org/status/fetch.php?pkg=rustc&arch=loong64&ver=1.96.1%2Bdfsg1-1&stamp=1790690148&raw=1 (warning, big) and there is another proposed fix on LKML: https://lore.kernel.org/lkml/9a2d420a1757516f1e9ad4e9a0e9f17b9ba92c72.1789628002.git.maciek.borze...@gmail.com/ I can confirm that that one on top of 7.2.7 fixed the issue for me (will send proper Tested-by tomorrow) on a non-buildd test run.
