Commit 9814077275ec for kernel

commit 9814077275eca36ebf8d510d2f076d235ff9f51a
Author: Fan Wu <wufan@kernel.org>
Date:   Tue Sep 22 20:13:48 2026 -0700

    ipe: fix use-after-free when auditing a newly loaded policy

    new_policy() audits the policy after ipe_new_policyfs_node() publishes it
    and drops the new directory's inode lock. A concurrent delete can free
    the policy while ipe_audit_policy_load() is still using it.

    Audit the successful load under that lock.

    Fixes: f44554b5067b ("audit,ipe: add IPE auditing support")
    Cc: stable@vger.kernel.org
    Assisted-by: LLM
    [FW: remove model name according to latest guideline]
    Signed-off-by: Fan Wu <wufan@kernel.org>

diff --git a/security/ipe/fs.c b/security/ipe/fs.c
index 076c111c85c8..847a76afb93d 100644
--- a/security/ipe/fs.c
+++ b/security/ipe/fs.c
@@ -159,18 +159,16 @@ static ssize_t new_policy(struct file *f, const char __user *data,
 	}

 	rc = ipe_new_policyfs_node(p);
-	if (rc)
-		goto out;

 out:
 	kfree(copy);
 	if (rc < 0) {
 		ipe_free_policy(p);
 		ipe_audit_policy_load(ERR_PTR(rc));
-	} else {
-		ipe_audit_policy_load(p);
+		return rc;
 	}
-	return (rc < 0) ? rc : len;
+
+	return len;
 }

 static const struct file_operations np_fops = {
diff --git a/security/ipe/policy_fs.c b/security/ipe/policy_fs.c
index 9d92d8a14b13..a7aeb57483c6 100644
--- a/security/ipe/policy_fs.c
+++ b/security/ipe/policy_fs.c
@@ -481,6 +481,9 @@ int ipe_new_policyfs_node(struct ipe_policy *p)
 	inode_lock(root);
 	p->policyfs = policyfs;
 	root->i_private = p;
+	/* Only audit signed policies from userspace */
+	if (p->pkcs7)
+		ipe_audit_policy_load(p);
 	inode_unlock(root);

 	return 0;