[PATCH] apparmor: Fix label reference leak in aa_unix_file_perm()

[Wentao Liang]

The inner block in aa_unix_file_perm() re-declares plabel, shadowing the
outer variable that is released at the out label. The reference taken by
aa_get_label_rcu() is thus lost when the block exits, and aa_put_label()
at out is a no-op on the still NULL outer plabel, leaking one label per
permission check on a non-filesystem unix socket.

Drop the shadowing declaration so the outer plabel is used and released.

Fixes: 88fec3526e84 ("apparmor: make sure unix socket labeling is correctly updated.")
Cc: stable at vger.kernel.org
Signed-off-by: Wentao Liang <vulab at iscas.ac.cn>
---
 security/apparmor/af_unix.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/security/apparmor/af_unix.c b/security/apparmor/af_unix.c
index fdb4a9f212c3..ecb40cfe7e14 100644
--- a/security/apparmor/af_unix.c
+++ b/security/apparmor/af_unix.c
@@ -758,7 +758,6 @@ int aa_unix_file_perm(const struct cred *subj_cred, struct aa_label *label,
 			   unix_fs_perm(op, request, subj_cred, label,
 					is_unix_fs(peer_sk) ? &peer_path : NULL));
 	} else if (!is_sk_fs) {
-		struct aa_label *plabel;
 		struct aa_sk_ctx *pctx = aa_sock(peer_sk);
 
 		rcu_read_lock();
-- 
2.34.1