kernel NULL pointer dereference in apparmor_parser

[Niklas Sombert]

Since about a month or so, I get many oopses from apparmor, such as this one:

[ 14.620816] BUG: kernel NULL pointer dereference, address: 0000000000000130
[ 14.620822] #PF: supervisor read access in kernel mode
[ 14.620825] #PF: error_code(0x0000) - not-present page
[ 14.620829] PGD 0 P4D 0
[ 14.620834] Oops: 0000 [#1] PREEMPT SMP PTI
[ 14.620838] CPU: 0 PID: 1105 Comm: apparmor_parser Not tainted 5.19.0-38-generic #39~22.04.1-Ubuntu
[ 14.620842] Hardware name: LENOVO 20FES3TE00/20FES3TE00, BIOS N1GETA2W (1.81 ) 06/12/2020
[ 14.620845] RIP: 0010:aa_unpack+0x127/0x540
[ 14.620853] Code: 00 48 85 c0 0f 84 29 04 00 00 48 8d 75 a0 48 8d 7d b0 4c 8b 7d c0 e8 e8 ea ff ff 48 89 c3 48 3d 00 f0 ff ff 0f 87 00 02 00 00 <4c> 8b b0 30 01 00 00 4d 85 f6 0f 84 38 01 00 00 49 8b 86 c8 00 00
[ 14.620857] RSP: 0018:ffffb07141cc3ce0 EFLAGS: 00010207
[ 14.620861] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 14.620864] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 14.620867] RBP: ffffb07141cc3d48 R08: 0000000000000000 R09: 0000000000000000
[ 14.620869] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb07141cc3da8
[ 14.620872] R13: ffffb07141cc3da0 R14: ffff9755c5518000 R15: ffff9755c5500010
[ 14.620875] FS: 00007f53ef091740(0000) GS:ffff9756f9600000(0000) knlGS:0000000000000000
[ 14.620879] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 14.620882] CR2: 0000000000000130 CR3: 0000000106b64006 CR4: 00000000003706f0
[ 14.620886] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 14.620888] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 14.620891] Call Trace:
[ 14.620893] <TASK>
[ 14.620899] aa_replace_profiles+0x97/0x1010
[ 14.620906] ? _copy_from_user+0x55/0x90
[ 14.620913] policy_update+0xdb/0x180
[ 14.620918] profile_replace+0xbb/0x150
[ 14.620923] vfs_write+0xb5/0x2a0
[ 14.620929] ksys_write+0x67/0xf0
[ 14.620933] __x64_sys_write+0x19/0x30
[ 14.620937] do_syscall_64+0x59/0x90
[ 14.620941] ? irqentry_exit_to_user_mode+0x9/0x20
[ 14.620946] ? irqentry_exit+0x43/0x50
[ 14.620949] ? exc_page_fault+0x92/0x1b0
[ 14.620954] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 14.620960] RIP: 0033:0x7f53eef14a37
[ 14.620964] Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
[ 14.620968] RSP: 002b:00007fffa3676028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 14.620972] RAX: ffffffffffffffda RBX: 00005628aad3df60 RCX: 00007f53eef14a37
[ 14.620975] RDX: 0000000000018000 RSI: 00005628aad6e810 RDI: 0000000000000006
[ 14.620978] RBP: 0000000000018000 R08: 0000000000000000 R09: 00005628aad6e810
[ 14.620980] R10: 0000000000000000 R11: 0000000000000246 R12: 00005628aad6e810
[ 14.620983] R13: 0000000000018000 R14: 00005628a9b26c5b R15: 0000000000000006
[ 14.620989] </TASK>
[ 14.620991] Modules linked in: snd_soc_avs snd_soc_skl snd_soc_hdac_hda snd_hda_ext_core snd_soc_sst_ipc snd_soc_sst_dsp snd_soc_acpi_intel_match snd_hda_codec_hdmi snd_soc_acpi snd_ctl_led snd_soc_core snd_hda_codec_conexant snd_compress snd_hda_codec_generic ac97_bus snd_pcm_dmaengine snd_hda_intel intel_rapl_msr snd_intel_dspcfg intel_rapl_common snd_intel_sdw_acpi intel_tcc_cooling x86_pkg_temp_thermal snd_hda_codec intel_powerclamp snd_hda_core btusb thinkpad_acpi btrtl binfmt_misc kvm_intel snd_hwdep nvram btbcm snd_pcm ledtrig_audio uvcvideo btintel kvm iwlmvm snd_seq_midi videobuf2_vmalloc btmtk mei_pxp mei_hdcp snd_seq_midi_event videobuf2_memops rapl mac80211 snd_rawmidi videobuf2_v4l2 input_leds intel_cstate bluetooth snd_seq videobuf2_common libarc4 joydev serio_raw hid_sensor_accel_3d hid_sensor_custom_intel_hinge hid_sensor_magn_3d hid_sensor_gyro_3d hid_sensor_als nls_iso8859_1 wmi_bmof think_lmi firmware_attributes_class snd_seq_device videodev ecdh_generic
[ 14.621071] hid_sensor_trigger iwlwifi snd_timer industrialio_triggered_buffer ecc mc kfifo_buf snd cfg80211 mei_me hid_sensor_iio_common intel_pch_thermal intel_xhci_usb_role_switch mei industrialio soundcore platform_profile mac_hid sch_fq_codel coretemp msr parport_pc ppdev ramoops pstore_blk lp reed_solomon efi_pstore parport pstore_zone ip_tables x_tables autofs4 btrfs blake2b_generic xor raid6_pq libcrc32c dm_crypt wacom usbhid hid_sensor_custom hid_sensor_hub hid_generic intel_ishtp_hid hid i915 drm_buddy i2c_algo_bit ttm drm_display_helper cec rc_core crct10dif_pclmul drm_kms_helper crc32_pclmul syscopyarea ghash_clmulni_intel sysfillrect sysimgblt aesni_intel fb_sys_fops nvme rtsx_pci_sdmmc i2c_i801 crypto_simd intel_ish_ipc xhci_pci cryptd drm psmouse e1000e nvme_core i2c_smbus rtsx_pci intel_ishtp xhci_pci_renesas wmi video
[ 14.621163] CR2: 0000000000000130
[ 14.621166] ---[ end trace 0000000000000000 ]---
[ 14.826766] RIP: 0010:aa_unpack+0x127/0x540
[ 14.826791] Code: 00 48 85 c0 0f 84 29 04 00 00 48 8d 75 a0 48 8d 7d b0 4c 8b 7d c0 e8 e8 ea ff ff 48 89 c3 48 3d 00 f0 ff ff 0f 87 00 02 00 00 <4c> 8b b0 30 01 00 00 4d 85 f6 0f 84 38 01 00 00 49 8b 86 c8 00 00
[ 14.826794] RSP: 0018:ffffb07141cc3ce0 EFLAGS: 00010207
[ 14.826799] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 14.826801] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 14.826803] RBP: ffffb07141cc3d48 R08: 0000000000000000 R09: 0000000000000000
[ 14.826806] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb07141cc3da8
[ 14.826808] R13: ffffb07141cc3da0 R14: ffff9755c5518000 R15: ffff9755c5500010
[ 14.826810] FS: 00007f53ef091740(0000) GS:ffff9756f9600000(0000) knlGS:0000000000000000
[ 14.826813] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 14.826816] CR2: 0000000000000130 CR3: 0000000106b64006 CR4: 00000000003706f0
[ 14.826819] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 14.826821] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

It's always 0000000000000130. Going through old logs, it started happening around 2023-03-18, so that would be 5.19.0-35-generic. But it didn't start with the upgrade to 5.19.0-35-generic, I have earlier boots with that version that don't error.

It doesn't error if I boot the non-HWE kernel (5.15.0-69-generic).

It doesn't seem to impact normal usage, but my firmware sometimes shows the message that the nonvolatile UEFI storage is almost full on boot, which seems to be caused by this.

$ lsb_release -rd
Description: Ubuntu 22.04.2 LTS
Release: 22.04
$ apt-cache policy linux-generic-hwe-22.04
linux-generic-hwe-22.04:
  Installed: 5.19.0.38.39~22.04.12
  Candidate: 5.19.0.38.39~22.04.12
  Version table:
 *** 5.19.0.38.39~22.04.12 500
        500 http://de.archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu jammy-security/main amd64 Packages
        100 /var/lib/dpkg/status
     5.15.0.25.27 500
        500 http://de.archive.ubuntu.com/ubuntu jammy/main amd64 Packages

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: linux-generic-hwe-22.04 5.19.0.38.39~22.04.12
ProcVersionSignature: Ubuntu 5.19.0-38.39~22.04.1-generic 5.19.17
Uname: Linux 5.19.0-38-generic x86_64
ApportVersion: 2.20.11-0ubuntu82.3
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Sat Apr 15 13:07:40 2023
InstallationDate: Installed on 2015-12-11 (2681 days ago)
InstallationMedia: Kubuntu 14.04.3 LTS "Trusty Tahr" - Beta amd64 (20150805)
SourcePackage: linux-meta-hwe-5.19
UpgradeStatus: No upgrade log present (probably fresh install)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.