Re: [PATCH] apparmor: handle NULL peer label in AF_UNIX context updates

[Aurelien Jarno <aurelien@aurel32.net>]

Hi,

On 2026-09-17 09:15, Maciek Borzecki wrote:
> When a confined process performs the first file permission revalidation on
> an AF_UNIX socket, both update_sk_ctx() and update_peer_ctx() can be called
> before the socket's peer label cache (ctx->peer) has been populated. In
> those cases they pass NULL as a label argument to aa_label_is_subset() or
> aa_label_merge(), which immediately dereferences label->size and causes an
> Oops:
> 
>   RIP: __aa_label_next_not_in_set+0xd/0x110
>   CR2: 000000000000004c
>   Call Trace:
>     aa_label_is_subset
>     aa_unix_file_perm
>     aa_file_perm
>     apparmor_file_permission
>     security_file_permission
>     rw_verify_area
>     vfs_write
>     ksys_write
> 
> Observed on Arch Linux kernels 7.2.4-arch1-2 and 7.2.6-arch2-1, triggered
> by snapd unit tests writing to a connected AF_UNIX socket. The issue
> persists across those stable updates.
> 

It appears to be the same issue as reported here:
https://bugs.debian.org/1145111

And a patch that looks similar to yours has already been posted:
https://lore.kernel.org/20260824155822.9214-1-maxime.belair@canonical.com

As it seems you have looked at the bug in details, you can maybe comment 
it and add a Tested-by: and/or Reviewed-by:, that might help to make 
things progress.

Regards
Aurelien

-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                     http://aurel32.net