[PATCH security v1] apparmor: fix a use-after-free in aa_lookupn_ns()

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] apparmor: incorrect documentation for aa_get_ns_not0()
--

commit fda3772b41365651e2bf01f14c3712bb81c8786a
Author: Binbin Deng <18983559317 at 163.com>

apparmor: fix a use-after-free in aa_lookupn_ns()

This commit addresses a use-after-free bug in aa_lookupn_ns() caused by
concurrent removal of namespaces. It introduces aa_get_ns_not0() to safely
attempt incrementing the reference count only if the namespace is not already
being freed.

> diff --git a/security/apparmor/include/policy_ns.h b/security/apparmor/include/policy_ns.h
> index cc6e841518120..4f83598754764 100644
> --- a/security/apparmor/include/policy_ns.h
> +++ b/security/apparmor/include/policy_ns.h

[ ... ]

> @@ -117,6 +117,22 @@ static inline struct aa_ns *aa_get_ns(struct aa_ns *ns)
>  	return ns;
>  }
>  
> +/**
> + * aa_get_ns_not0 - increment references count on @ns found via lookup
> + * @ns: namespace to increment reference count of (MAYBE NULL)
> + *
> + * Returns: pointer to @ns, if @ns is NULL returns NULL,
> + *          NULL if @ns is being freed
> + * Requires: @ns must be held with valid refcount when called

[Severity: Low]
Does this documentation contradict the purpose of the newly introduced function?

The function aa_get_ns_not0() is explicitly designed to safely handle
namespaces where the reference count might have already dropped to zero, which
fixes the use-after-free bug. However, the documentation requires the caller
to already hold a valid refcount, which defeats the purpose of checking for
zero.

Should this state that an RCU read lock is required to protect the lookup
pointer instead?

> + */
> +static inline struct aa_ns *aa_get_ns_not0(struct aa_ns *ns)
> +{
> +	if (ns && aa_get_profile_not0(ns->unconfined))
> +		return ns;
> +
> +	return NULL;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926044724.4187-1-18983559317@163.com?part=1