[PATCH 0/2] ipe: fix two use-after-frees

[Fan Wu]

This series fixes two use-after-free bugs in IPE, both found by a recent
AI-assisted code scan.

The first one is in the policy load audit path, where a concurrent
delete can free the policy while it is being audited. The second one is
in the dm-verity root hash path, where ->preresume can free a digest
that policy evaluation is still using.

Fan Wu (2):
  ipe: fix use-after-free when auditing a newly loaded policy
  ipe: protect the dm-verity root hash with RCU

 security/ipe/eval.c      | 12 ++++++++----
 security/ipe/eval.h      |  2 +-
 security/ipe/fs.c        |  8 +++-----
 security/ipe/hooks.c     | 22 +++++++++++++++++-----
 security/ipe/policy_fs.c |  3 +++
 5 files changed, 32 insertions(+), 15 deletions(-)


base-commit: 93f51579e7df248780214094418f205253383cc5
-- 
2.55.0