Ben Hutchings 147fa180c9 apparmor: validate default DFA states are in bounds ...

Some backports of commit 9063d7e2615f ("apparmor: validate DFA start
states are in bounds in unpack_pdb") limited the bounds checks on DFA
start states to the case where the start state was explicit in the
policy.  However, the default DFA start state (DFA_START = 1) could
also be out-of-bounds.

Move these checks out of the else-branches so that they are applied
regardless of how the start state was initialised.

Fixes: f43eea8ae010 ("apparmor: validate DFA start states are in bounds in unpack_pdb")
Signed-off-by: Ben Hutchings <benh@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>

2026-08-04 11:22:16 +02:00

..

include

apparmor: fix differential encoding verification

2026-05-07 12:59:01 +02:00

.gitignore

…

apparmorfs.c

apparmor: fix unprivileged local user can do privileged policy management

2026-05-07 10:55:26 +02:00

audit.c

…

capability.c

apparmor: fix 'Do simple duplicate message elimination'

2024-12-05 10:59:38 +01:00

crypto.c

…

domain.c

…

file.c

…

ipc.c

…

Kconfig

…

label.c

…

lib.c

…

lsm.c

…

Makefile

…

match.c

apparmor: fix differential encoding verification

2026-05-07 12:59:01 +02:00

mount.c

…

net.c

apparmor: fix NULL sock in aa_sock_file_perm

2026-04-09 14:44:47 +08:00

nulldfa.in

…

path.c

…

policy_ns.c

apparmor: fix: limit the number of levels of policy namespaces

2026-05-07 10:55:26 +02:00

policy_unpack.c

apparmor: validate default DFA states are in bounds

2026-08-04 11:22:16 +02:00

policy.c

apparmor: fix unprivileged local user can do privileged policy management

2026-05-07 10:55:26 +02:00

procattr.c

…

resource.c

apparmor: fix rlimit for posix cpu timers

2026-04-12 13:56:29 +08:00

secid.c

…

stacksplitdfa.in

…

task.c

…