From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 25F2F258CDF for ; Mon, 9 Feb 2026 09:44:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770630246; cv=none; b=W4iT1wAMkSsb8BhqPT0gmAQ2fBRBmL7k8j/md357PTHIYtmFLLiA8kCJWFrd+fM5fMw+AcbVwm6wjoPSfdiSlwDSYBoz0d92fw/suECXabZZiZMb2WxC3asQ2RzET67g1a2VwMirb0db072LaeIoXl2aMsmGzoufg1fzoTYJHyo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770630246; c=relaxed/simple; bh=ffwyycNGsHUYL30inQKYg1B9vqvK8ooS80/3W+GE+zw=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition:In-Reply-To; b=BTxErUhSIV9Gta64IS5sdQb1MEqaxXZJ0GKSixZYlNUNnZBC0yfFNC1NZ9wCwbhltIcr2MZE0DMrDLvyJKNYeCE/vh8ugNXWtW8ZJUzWEWWro3o+ouGviXjRPZS3Gtb1Mx5tQ6aZRoDcCMhSxRDap/+kFKavugJbxs1f027RHGs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=edpioi9G; arc=none smtp.client-ip=209.85.128.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="edpioi9G" Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4801d7c72a5so23478045e9.0 for ; Mon, 09 Feb 2026 01:44:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1770630244; x=1771235044; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:message-id:subject:cc :to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=WCsTGNRwCHOXdV60evM4B/ieoAWEQi135YEapFnAevA=; b=edpioi9G1pzbSrGaGxgg/YT+1Ush1G18vTy4p4L50V1vyI5j+FD7RgQMwdlri9m8x4 2kWC6LJzqav1uoTEc6vw/m7NLwofsQgCidC5b9UeBR67uotTS4QHa2TbYIvGXS+nZpfx kHgpVP7HGWaR6ZSSJ1PPQ8clhBWZnPJwl2uhzW4zjZ11EMOOKm2C1LDCONzCT53ZJ8WP y/1+JbzSX8YSoYTajI++fJDGxoo9Njb8yEXqUL/Ig0IXJpPGCAR/uifjW6wMWag/eLmM /6Y1U3Vi7I6IVvPJr4aUHu+0xf42qrmdegWSq7YnodWl5a0NPvAY/26Y/pNoNWDSZZxV 8wag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770630244; x=1771235044; h=in-reply-to:content-disposition:mime-version:message-id:subject:cc :to:from:date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=WCsTGNRwCHOXdV60evM4B/ieoAWEQi135YEapFnAevA=; b=lHbXOihYSW5ROumot4gFUb0uxVRy34NAt8TCIY94S1EpxUrRmn6Ll2jFtVTUDp1qiT 6HOVIUq2Mk3bwHVYlOa8rrcYNVUbvZC1ZTT2FsF8r2dNevuxF5UL5LnC4W1vSULDQGe+ +c2AFh07oGfN8ue/Jtfrngt770nAgGzVOczfu2PBc+BQ1ZyyhZ6Lu9j5rfP1xdNzanQ8 vQHvdHEQ/7VVlBSCgltViRBDXbO2Dg7UZOSjBV+HV7uL976mE3vOx7UP09K/rGQtkl4T W2KIoiV7OkXhB79NdhCCppRPeC5sRqeKegl7Dst8vdGE9Q1guBfkkOM1m4aUXslibv2J ZTAg== X-Forwarded-Encrypted: i=1; AJvYcCWhB/PrWniShkCmzITFrfPNB/yp4vHo5Fhf8FFv5FZUDnWEBkGSWK/7VfP5dmsq9VI7SNIa8JXxYXvE6DQ=@vger.kernel.org X-Gm-Message-State: AOJu0YyAAW+NR6XRFhDOtUFo7M1wrmECLquyAUlI+e0XxPwfYCm0CIHH VF0j8JnF1jgQHhoOozsc5GLIXG23WVRcjD/En6OSZL8If9rl6I2UHWoYa8tKKRhZKGg= X-Gm-Gg: AZuq6aKZ5GU0l3lak7PWLewtGoiTNDoBA3L2+Nfz4YzmmxBg3Odjhy8yGtQvZ2DtDPb HT3XloDNlm9bpsWBK4Hmu93nUwIbPdNNBio9EiCeV8Z02b+4qA/w0cNn8Yp9JwkcL5sVDLr5dUG Qi5Qql0WIAzXufCT9iOIieUuQEQo9cTFFqcTUqYsBvTC/JJHS9RnHTwhuzO4uMIwgFPR+IkxbAK 0BmBNhv1uAK9wFMj2kEsZeEuOnFucrAEOG8yN/kJPKiWXwAsQ5xrwqv2Jtr4/YM1ekrRENfk6eZ rlvp5BezojB/D+o6cXeXvYG50Ds0F/Z5R71ywgGezPxN2i95wWwZijyzeEKY4BLVZ5WLi89WTfV IiCfbg6sAnNwgP5KogxvEJHYZvXEZmzG/RsHNi8KUPyQsocGRQGLj1pyUB5DN6REZRcrQC5dXHg jVaR/LiQLVdkxMXG7m X-Received: by 2002:a05:600c:6290:b0:47e:e78a:c834 with SMTP id 5b1f17b1804b1-48320226676mr171207675e9.34.1770630244378; Mon, 09 Feb 2026 01:44:04 -0800 (PST) Received: from localhost ([196.207.164.177]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48317d2ba61sm480009135e9.1.2026.02.09.01.44.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Feb 2026 01:44:03 -0800 (PST) Date: Mon, 9 Feb 2026 12:44:01 +0300 From: Dan Carpenter To: John Johansen Cc: apparmor@lists.ubuntu.com, linux-security-module@vger.kernel.org, linux-kernel Subject: [bug report] apparmor: add support loading per permission tagging Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: [ Smatch checking is paused while we raise funding. #SadFace https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ] Hello John Johansen, Commit 3d28e2397af7 ("apparmor: add support loading per permission tagging") from Apr 1, 2025 (linux-next), leads to the following Smatch static checker warning: security/apparmor/policy_unpack.c:966 unpack_pdb() warn: unsigned 'unpack_tags(e, &pdb->tags, info)' is never less than zero. security/apparmor/policy_unpack.c 951 static int unpack_pdb(struct aa_ext *e, struct aa_policydb **policy, 952 bool required_dfa, bool required_trans, 953 const char **info) 954 { 955 struct aa_policydb *pdb; 956 void *pos = e->pos; 957 int i, flags, error = -EPROTO; 958 ssize_t size; 959 u32 version = 0; 960 961 pdb = aa_alloc_pdb(GFP_KERNEL); 962 if (!pdb) 963 return -ENOMEM; 964 965 AA_DEBUG(DEBUG_UNPACK, "unpacking tags"); --> 966 if (unpack_tags(e, &pdb->tags, info) < 0) ^^^^^^^^^^^ Signedness bug. unpack_tags() is unsigned. 967 goto fail; 968 AA_DEBUG(DEBUG_UNPACK, "done unpacking tags"); 969 970 size = unpack_perms_table(e, &pdb->perms); 971 if (size < 0) { 972 error = size; 973 pdb->perms = NULL; regards, dan carpenter