From nobody Wed Feb 11 04:17:51 2026 Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 730D2318EF5 for ; Tue, 10 Feb 2026 17:16:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770743777; cv=none; b=p1qLGarvTl4rXRIsFIjpeyNmVqvBBBwm8IOuOZ69FNCN1mtvaVZHeNzQU0tfv7Y4R/0Fo9KvFYQzijK6eP2fdfUtupMhq391C2aHNfZYIte8dL0qLjaLjIS7YdcR6LuPzC1lXrQfzu2avv0C4JCBVdyC9AlVj+vczM31w5p2hY8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770743777; c=relaxed/simple; bh=nUcnFETHII0E5rlg2qpCCtkxf6FnxvfXs8nFpP50wMY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kkg0UOji/f4GnOuXB3r9mIn+0JPMsK2GF7ygULvaBydDkhHf97durmdeoZrJvb9PDP+lJ04+kx3E4Sc+hsvdgk/FXnLjCuokdN2TuqClZiw9isWCAEpiL7vRQqWohu8g+CypWQ98k/HjwfHdB/spu+R5jSdvVnXGesoWTUJMg6o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=h2jqyD92; arc=none smtp.client-ip=209.85.128.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="h2jqyD92" Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-47ee0291921so42927405e9.3 for ; Tue, 10 Feb 2026 09:16:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1770743775; x=1771348575; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=AMHj8ip2bDcru9Om4PYAVrUfxZXZ6ZycN6CABi5KwTU=; b=h2jqyD92Ra8faD6auyClFadlmMNYFfuYKbq3/CbTPhkEeMXeRlL9/poPeuIN4RGD7n NGrBjYelTgon6c/R9rWQ1eKu8vCAcTtg4/eTOOgclzdHoO3wV68wlIqD1R9SFyOmOyqW LaGT58+pvFCxte/UP5deMmDvb0FF7veVIZh6PhoiIcwnqPGy4C6e1fkY/MccnrY/MELY iqczI9zmHq3zp9+iJVfW3ZtNG53YvdxtSu3eDWxPy/kM4Ycva6W9G6mWxo+r1eUiL4G9 RJZZGUhS3+AB9LmEe1e7T7LrwFkXVJzw2oVlF7r07E6gP6w0/Yxx4AqGeDDmHPKqmBwJ dpCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770743775; x=1771348575; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=AMHj8ip2bDcru9Om4PYAVrUfxZXZ6ZycN6CABi5KwTU=; b=fmTaTgSxTdiCXFZe9kADvwJ7sZ0wC7T4ozT+xYRFazdu7j47CEizawKeogUMbkc7SJ 0z+lbONxSkhVeSNAkyg7EMOuwlgcHk04MjjLLEgudgM9xHa9KfgPw7C/SnnhG8mzwcyx haMKrpnxxgd3yzN+K1WQrLATmzdx9T52h1m0gpJ3cfT+5eTKKySGj1aIesxDEqBM8+6Q n7knlvKejA/Hz4IGlL8kPVzyBL7JYmeo4/EB1/Fn8gNHLZujsgQHIzjNNw7lqOCqSgu8 Xa9RpNzWB3rZF2t3cxBKyWixl+RLyYQK0tyk9WAmNEfNsSzNVzfvhq2zEN1CbYvFd49e fIXw== X-Forwarded-Encrypted: i=1; AJvYcCWnpn6V0CTqqTto8xe0J9FtY94WZM2hRfWyDEbXLTDaFv9FWtSRiG0v+RxqBrIgf0Q+Jm5X6oCVX4T6zLU=@vger.kernel.org X-Gm-Message-State: AOJu0Yy2WCfTH3BB+5C0JxZ3xU6DltxMbZ7KNZCgXsDuafV2pnropuOy +jlXAUTGUIhPhCSTEvzYQhqCpah82bHIiMucFqYCY+zOyG4BWHZ9gzGT X-Gm-Gg: AZuq6aIJPfsYtSlcdeVMBhorC0JNGRxaQuPqAmNzdXT0gcPnjDiNKI8haIqsOWSGukv WGI46/NWQwITL5WkLL8rqZTEv7JNrt/hSaXmw9XnjKcSbR91krlLgXAos9q3aTVB6cLoQ10F+77 6vHPh1VwExAzlQaUZylSxNaNScq1GluzqJuYc1xPAOe+6XsloU9pgcsfFMLZ0ML6y+Jlsj4V3iD HGDyROvNQRp4P5/zUUcvZ5hQ0/LoqQN/QK7kAZs2TgHyZpGVX5XtPiJPSGpGACaZepzYZQOdjLk qLw9v9tq4ycsLICJhxU/bTsbjGaD1bDxraFItXY6n3up5x5bMDo6KLvSLM1qUgNq1oMcsjRycq7 B6OtZPaLcqtuteGE8kx06c5C/DgxbeXAwKau49YwWHcN0xgm+uXTDPqSfGkdP/0uWnfELaIsDBv q1SuyEiBciPu5NhIQBVbi/LQrseC+7ywjsbHB/UVli00oFSC5QO3viZlSen3i7PA== X-Received: by 2002:a05:600c:6290:b0:47e:e78a:c834 with SMTP id 5b1f17b1804b1-48320226676mr252050135e9.34.1770743774563; Tue, 10 Feb 2026 09:16:14 -0800 (PST) Received: from geekom-a8 (net-93-66-82-32.cust.vodafonedsl.it. [93.66.82.32]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4834d7f1e4fsm97562565e9.15.2026.02.10.09.16.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 10 Feb 2026 09:16:14 -0800 (PST) From: Massimiliano Pellizzer To: john.johansen@canonical.com Cc: apparmor@lists.ubuntu.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, dan.carpenter@linaro.org, Massimiliano Pellizzer Subject: [apparmor][PATCH] apparmor: fix signedness bug in unpack_tags() Date: Tue, 10 Feb 2026 18:15:38 +0100 Message-ID: <20260210171538.534950-1-mpellizzer.dev@gmail.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Smatch static checker warning: security/apparmor/policy_unpack.c:966 unpack_pdb() warn: unsigned 'unpack_tags(e, &pdb->tags, info)' is never less than ze= ro. unpack_tags() is declared with return type size_t (unsigned) but returns negative errno values on failure. The caller in unpack_pdb() tests the return with `< 0`, which is always false for an unsigned type, making error handling dead code. Malformed tag data would be silently accepted instead of causing a load failure. Change return type of unpack_tags() from size_t to int to match the functions's actual semantic. Fixes: 3d28e2397af7 ("apparmor: add support loading per permission tagging") Reported-by: Dan Carpenter Signed-off-by: Massimiliano Pellizzer --- security/apparmor/policy_unpack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_u= npack.c index e68adf39771f..dc908e1f5a88 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -835,7 +835,7 @@ static int unpack_tag_headers(struct aa_ext *e, struct = aa_tags_struct *tags) } =20 =20 -static size_t unpack_tags(struct aa_ext *e, struct aa_tags_struct *tags, +static int unpack_tags(struct aa_ext *e, struct aa_tags_struct *tags, const char **info) { int error =3D -EPROTO; --=20 2.51.0