apparmor: fix race between freeing data and fs accessing it

apparmor: fix missing bounds check on DEFAULT table in verifydfa()

apparmor: fix differential encoding verification

apparmor: Fix & Optimize table creation from possibly unaligned memory

apparmor: fix: limit the number of levels of policy namespaces

apparmor: replace recursive profile removal with iterative approach

In the Linux kernel, the following vulnerability has been resolved:

apparmor: avoid per-cpu hold underflow in aagetbuffer

When aagetbuffer() pulls from the per-cpu list it unconditionally decrements cache->hold. If hold reaches 0 while count is still non-zero, the unsigned decrement wraps to UINTMAX. This keeps hold non-zero for a very long time, so aaputbuffer() never returns buffers to the global list, which can starve other CPUs and force repeated kmalloc(aagpathmax) allocations.

Guard the decrement so hold never underflows.

AppArmor: Allow apparmor to handle unaligned dfa tables