Patch "apparmor: fix lockdep warning when removing a namespace" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    apparmor: fix lockdep warning when removing a namespace

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     apparmor-fix-lockdep-warning-when-removing-a-namespa.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit dbfed283c1c03a9ff2dd873a7c8a1db615244946
Author: John Johansen <john.johansen@xxxxxxxxxxxxx>
Date:   Tue Sep 6 03:39:55 2022 -0700

    apparmor: fix lockdep warning when removing a namespace
    
    [ Upstream commit 9c4557efc558a68e4cd973490fd936d6e3414db8 ]
    
    Fix the following lockdep warning
    
    [ 1119.158984] ============================================
    [ 1119.158988] WARNING: possible recursive locking detected
    [ 1119.158996] 6.0.0-rc1+ #257 Tainted: G            E    N
    [ 1119.158999] --------------------------------------------
    [ 1119.159001] bash/80100 is trying to acquire lock:
    [ 1119.159007] ffff88803e79b4a0 (&ns->lock/1){+.+.}-{4:4}, at: destroy_ns.part.0+0x43/0x140
    [ 1119.159028]
                   but task is already holding lock:
    [ 1119.159030] ffff8881009764a0 (&ns->lock/1){+.+.}-{4:4}, at: aa_remove_profiles+0x3f0/0x640
    [ 1119.159040]
                   other info that might help us debug this:
    [ 1119.159042]  Possible unsafe locking scenario:
    
    [ 1119.159043]        CPU0
    [ 1119.159045]        ----
    [ 1119.159047]   lock(&ns->lock/1);
    [ 1119.159051]   lock(&ns->lock/1);
    [ 1119.159055]
                    *** DEADLOCK ***
    
    Which is caused by an incorrect lockdep nesting notation
    
    Fixes: feb3c766a3ab ("apparmor: fix possible recursive lock warning in __aa_create_ns")
    Signed-off-by: John Johansen <john.johansen@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 06355717ee84..e38ceba39200 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -1123,7 +1123,7 @@ ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj,
 
 	if (!name) {
 		/* remove namespace - can only happen if fqname[0] == ':' */
-		mutex_lock_nested(&ns->parent->lock, ns->level);
+		mutex_lock_nested(&ns->parent->lock, ns->parent->level);
 		__aa_bump_ns_revision(ns);
 		__aa_remove_ns(ns);
 		mutex_unlock(&ns->parent->lock);