This series fixes two use-after-free bugs in IPE, both found by a recent
AI-assisted code scan.

The first one is in the policy load audit path, where a concurrent
delete can free the policy while it is being audited. The second one is
in the dm-verity root hash path, where ->preresume can free a digest
that policy evaluation is still using.

Fan Wu (2):
  ipe: fix use-after-free when auditing a newly loaded policy
  ipe: protect the dm-verity root hash with RCU

 security/ipe/eval.c      | 12 ++++++++----
 security/ipe/eval.h      |  2 +-
 security/ipe/fs.c        |  8 +++-----
 security/ipe/hooks.c     | 22 +++++++++++++++++-----
 security/ipe/policy_fs.c |  3 +++
 5 files changed, 32 insertions(+), 15 deletions(-)


base-commit: 93f51579e7df248780214094418f205253383cc5
-- 
2.55.0

On 9/22/2026 8:13 PM, Fan Wu wrote:
> This series fixes two use-after-free bugs in IPE, both found by a recent
> AI-assisted code scan.
> 
> The first one is in the policy load audit path, where a concurrent
> delete can free the policy while it is being audited. The second one is
> in the dm-verity root hash path, where ->preresume can free a digest
> that policy evaluation is still using.
> 
> Fan Wu (2):
>   ipe: fix use-after-free when auditing a newly loaded policy
>   ipe: protect the dm-verity root hash with RCU
> 
>  security/ipe/eval.c      | 12 ++++++++----
>  security/ipe/eval.h      |  2 +-
>  security/ipe/fs.c        |  8 +++-----
>  security/ipe/hooks.c     | 22 +++++++++++++++++-----
>  security/ipe/policy_fs.c |  3 +++
>  5 files changed, 32 insertions(+), 15 deletions(-)
> 
> 
> base-commit: 93f51579e7df248780214094418f205253383cc5

I added both into ipe/text for testing.

-Fan