Ben Hutchings 64f25ebc10 apparmor: validate default DFA states are in bounds ...

Some backports of commit 9063d7e261 ("apparmor: validate DFA start
states are in bounds in unpack_pdb") limited the bounds checks on DFA
start states to the case where the start state was explicit in the
policy.  However, the default DFA start state (DFA_START = 1) could
also be out-of-bounds.

Move these checks out of the else-branches so that they are applied
regardless of how the start state was initialised.

Fixes: f43eea8ae0 ("apparmor: validate DFA start states are in bounds in unpack_pdb")
Signed-off-by: Ben Hutchings <benh@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-06-19 13:21:49 +02:00

..

apparmor

apparmor: validate default DFA states are in bounds

2026-06-19 13:21:49 +02:00

bpf

…

integrity

ima: check return value of crypto_shash_final() in boot aggregate

2026-06-01 17:29:35 +02:00

keys

use less confusing names for iov_iter direction initializers

2026-06-19 13:21:45 +02:00

loadpin

…

lockdown

…

safesetid

safesetid: check size of policy writes

2025-03-13 12:47:01 +01:00

selinux

selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len

2025-06-27 11:04:20 +01:00

smack

smack: /smack/doi: accept previously used values

2026-03-04 07:19:29 -05:00

tomoyo

tomoyo: don't emit warning in tomoyo_write_control()

2025-03-13 12:47:01 +01:00

yama

…

commoncap.c

…

device_cgroup.c

…

inode.c

securityfs: don't pin dentries twice, once is enough...

2025-08-28 16:22:40 +02:00

Kconfig

…

Kconfig.hardening

…

lsm_audit.c

…

Makefile

…

min_addr.c

…

security.c

xen/privcmd: add boot control for restricted usage in domU

2026-04-18 10:31:03 +02:00