[GIT PULL] AppArmor bugfixes for 7.4

[GIT PULL] AppArmor bugfixes for 7.4

[John Johansen]

Hi Linus,

This is the current set of outstanding bug fixes that have passed,
merge, build, and regression testing. Integrating new tests for all
this has been a lot of CI "fun", but it is looking good now.


The full break down of the fixes by issue type is in the tag message
below. All the patches have Fixes tags except for the trivial
kernel-doc fix.

The big one to call out in this set is
   4de32fd05ce9e apparmor: fix NULL ctx->peer derefs in unix socket ctx updates
which can be trivially be used to cause an oops.

I can split this up into smaller sets, and resend if you would like.

thanks
- john


The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:

   Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)

are available in the Git repository at:

   git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor tags/apparmor-pr-2026-10-29

for you to fetch changes up to ed35bbe7d06e6505401eff3f3c7a36bd1f167a17:

   apparmor: fix uninitialized variable warning in aa_inherit_files (2026-10-29 17:02:50 -0700)

----------------------------------------------------------------

* Bug Fixes
   - Leaks
     - fix a leak on a rejected string table entry
     - fix refcount leak in aa_get_newest_profile()
     - fix profile leak when a policy load fails
     - remove fs entries created by a failed policy load
     - on failed load ensure profile files are removed before parent
     - Fix namespace reference leak in __aa_find_or_create_ns()

   - Use after free/double free
     - fix a use-after-free in aa_lookupn_ns()
     - avoid potential double free when remapping DFA tables

   - Bounds checking by-passes
     - fix table_size() integer overflow on 32 bit
     - check accept index + 1 is in bounds

   - Mediation fixes
     - Fix AF_UNSPEC mediation
       - check address length before reading AF_UNSPEC bind address
       - mediate AF_UNSPEC socket disconnects
     - Fix sctp connect/bind by-passess
       - advertise that sctp is being mediated
       - fix check SCTP bind, and connect permission checks
       - check connect permission for SCTP

     - incorrect state machine traversal
       -  convert duplicated dfa transitions to match_char()

     - locking issues
       - don't revalidate inherited files under files->file_lock
       - fix uninitialized variable warning in aa_inherit_files

     - Bad dereferences
       - fix NULL ctx->peer derefs in unix socket ctx updates

   - unnecessary warnings
     - remove unconfined_profile() check in inet socket mediation

   - Kernel Doc
     - Fix the return value in split_token_from_name() kernel-doc

   - Misc
     - fix query_data() output overlapping the lookup key
     - report a label allocation failure as -ENOMEM

----------------------------------------------------------------
Binbin Deng (1):
       apparmor: fix a use-after-free in aa_lookupn_ns()

Cen Zhang (Microsoft) (1):
       apparmor: fix query_data() output overlapping the lookup key

Georgia Garcia (3):
       apparmor: don't revalidate inherited files under files->file_lock
       apparmor: remove fs entries created by a failed policy load
       apparmor: fix profile leak when a policy load fails

Guanglei Zhu (1):
       apparmor: check accept index + 1 is in bounds

John Johansen (6):
       apparmor: fix refcount leak in aa_get_newest_profile()
       apparmor: remove unconfined_profile() check in inet socket mediation
       apparmor: fix check SCTP bind, and connect permission checks
       apparmor: advertise that sctp is being mediated
       apparmor: on failed load ensure profile files are removed before parent
       apparmor: fix uninitialized variable warning in aa_inherit_files

Jérémy Jean (1):
       apparmor: check connect permission for SCTP

Karl Mehltretter (1):
       apparmor: Fix the return value in split_token_from_name() kernel-doc

Li RongQing (1):
       apparmor: avoid potential double free when remapping DFA tables

Maxime Bélair (5):
       apparmor: fix NULL ctx->peer derefs in unix socket ctx updates
       apparmor: fix a leak on a rejected string table entry
       apparmor: report a label allocation failure as -ENOMEM
       apparmor: fix table_size() integer overflow on 32 bit
       apparmor: convert duplicated dfa transitions to match_char()

Michail Andreas Michalopoulos (1):
       apparmor: check address length before reading AF_UNSPEC bind address

Wentao Liang (1):
       apparmor: Fix namespace reference leak in __aa_find_or_create_ns()

shaos (1):
       apparmor: mediate AF_UNSPEC socket disconnects

  security/apparmor/af_inet.c           |  5 ++-
  security/apparmor/af_unix.c           | 20 +++++++-----
  security/apparmor/apparmorfs.c        | 15 +++++++--
  security/apparmor/file.c              | 61 ++++++++++++++++++-----------------
  security/apparmor/include/label.h     |  6 +++-
  security/apparmor/include/match.h     | 11 ++++++-
  security/apparmor/include/policy.h    | 20 ++++++++++++
  security/apparmor/include/policy_ns.h | 16 +++++++++
  security/apparmor/label.c             | 15 ++++++---
  security/apparmor/lsm.c               | 19 +++++++++++
  security/apparmor/match.c             | 61 ++++++++++++++---------------------
  security/apparmor/net.c               |  4 +--
  security/apparmor/policy.c            | 19 +++++++++++
  security/apparmor/policy_ns.c         |  8 +++--
  security/apparmor/policy_unpack.c     | 23 +++++++++++--
  security/apparmor/procattr.c          |  3 +-
  16 files changed, 212 insertions(+), 94 deletions(-)


thanks
- john