aa_audit_cache_insert() returns either the newly inserted node or an existing matching node. Its additional reference belongs to the returned node. When that is an existing entry, insert_in_cache() updates it, releases the temporary reference, and returns false. The temporal-cache branch ignores that result and initializes and schedules delayed work on the candidate anyway. Once its ordinary references disappear, aa_audit_node_free_kref() queues its RCU reclamation. The RCU head and delayed work also share a union, so reclamation can corrupt the work structure before the allocation is finally freed. The pending timer subsequently accesses invalid storage.
I have absolutely no conception of a clue how Ubuntu contribution process works so I am just attaching a patch. The issue is trivially discoverable if you just try to actually use your software, yet it legitimately makes it hard to use Ubuntu. ** Patch added: "0001-apparmor-only-schedule-expiry-for-inserted-audit-nodes.patch" https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2156855/+attachment/6001125/+files/0001-apparmor-only-schedule-expiry-for-inserted-audit-nodes.patch -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2156855 Title: linux 7.0.0-22: timer-wheel use-after-free — NULL write in __run_timers (RAX=LIST_POISON2) from timer softirq, panics in idle task To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2156855/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
