Merge tag 'apparmor-pr-2026-10-29' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor

Pull AppArmor fixes from John Johansen:
 "Leaks:
   - fix a leak on a rejected string table entry
   - fix refcount leak in aa_get_newest_profile()
   - fix profile leak when a policy load fails
   - remove fs entries created by a failed policy load
   - on failed load ensure profile files are removed before parent
   - Fix namespace reference leak in __aa_find_or_create_ns()

  Use after free/double free:
   - fix a use-after-free in aa_lookupn_ns()
   - avoid potential double free when remapping DFA tables

  Bounds checking by-passes:
   - fix table_size() integer overflow on 32 bit
   - check accept index + 1 is in bounds

  Mediation fixes:
   - Fix AF_UNSPEC mediation
      - check address length before reading AF_UNSPEC bind address
      - mediate AF_UNSPEC socket disconnects
   - Fix sctp connect/bind by-passess
      - advertise that sctp is being mediated
      - fix check SCTP bind, and connect permission checks
      - check connect permission for SCTP
   - incorrect state machine traversal
      -  convert duplicated dfa transitions to match_char()
   - locking issues
      - don't revalidate inherited files under files->file_lock
      - fix uninitialized variable warning in aa_inherit_files
   - Bad dereferences
      - fix NULL ctx->peer derefs in unix socket ctx updates

  Unnecessary warnings:
   - remove unconfined_profile() check in inet socket mediation

  Kernel Doc:
   - Fix the return value in split_token_from_name() kernel-doc

  Misc:
   - fix query_data() output overlapping the lookup key
   - report a label allocation failure as -ENOMEM"

* tag 'apparmor-pr-2026-10-29' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: (23 commits)
  apparmor: fix uninitialized variable warning in aa_inherit_files
  apparmor: fix profile leak when a policy load fails
  apparmor: on failed load ensure profile files are removed before parent
  apparmor: remove fs entries created by a failed policy load
  apparmor: fix query_data() output overlapping the lookup key
  apparmor: advertise that sctp is being mediated
  apparmor: fix check SCTP bind, and connect permission checks
  apparmor: check connect permission for SCTP
  apparmor: fix a use-after-free in aa_lookupn_ns()
  apparmor: Fix namespace reference leak in __aa_find_or_create_ns()
  apparmor: check accept index + 1 is in bounds
  apparmor: Fix the return value in split_token_from_name() kernel-doc
  apparmor: convert duplicated dfa transitions to match_char()
  apparmor: fix table_size() integer overflow on 32 bit
  apparmor: avoid potential double free when remapping DFA tables
  apparmor: report a label allocation failure as -ENOMEM
  apparmor: fix a leak on a rejected string table entry
  apparmor: remove unconfined_profile() check in inet socket mediation
  apparmor: fix refcount leak in aa_get_newest_profile()
  apparmor: check address length before reading AF_UNSPEC bind address
  ...