[PATCH] apparmor: Fix label reference leak in aa_unix_file_perm()

[John Johansen]

On 9/17/26 12:19, Ryan Lee wrote:
> On Thu, Sep 17, 2026 at 11:59 AM Wentao Liang <vulab at iscas.ac.cn> wrote:
>>
>> The inner block in aa_unix_file_perm() re-declares plabel, shadowing the
>> outer variable that is released at the out label. The reference taken by
>> aa_get_label_rcu() is thus lost when the block exits, and aa_put_label()
>> at out is a no-op on the still NULL outer plabel, leaking one label per
>> permission check on a non-filesystem unix socket.
>>
>> Drop the shadowing declaration so the outer plabel is used and released.
>>
>> Fixes: 88fec3526e84 ("apparmor: make sure unix socket labeling is correctly updated.")
>> Cc: stable at vger.kernel.org
>> Signed-off-by: Wentao Liang <vulab at iscas.ac.cn>
>> ---
>>   security/apparmor/af_unix.c | 1 -
>>   1 file changed, 1 deletion(-)
>>
>> diff --git a/security/apparmor/af_unix.c b/security/apparmor/af_unix.c
>> index fdb4a9f212c3..ecb40cfe7e14 100644
>> --- a/security/apparmor/af_unix.c
>> +++ b/security/apparmor/af_unix.c
>> @@ -758,7 +758,6 @@ int aa_unix_file_perm(const struct cred *subj_cred, struct aa_label *label,
>>                             unix_fs_perm(op, request, subj_cred, label,
>>                                          is_unix_fs(peer_sk) ? &peer_path : NULL));
>>          } else if (!is_sk_fs) {
>> -               struct aa_label *plabel;
>>                  struct aa_sk_ctx *pctx = aa_sock(peer_sk);
>>
>>                  rcu_read_lock();
>> --
>> 2.34.1
>>
>>
> 
> NACK: this exact patch has been proposed before, and unfortunately
> exposes an additional latent bug around plabel handling that results
> in a use-after-free if the shadowed declaration is removed without
> additional fixes.
> 
> I can try to dig out the relevant exchange from the AppArmor mailing
> list later, if you'd be interested.
> 
The series Ryan is referring to is in Linus's tree, so you should see the
fix rolling out to stable kernels as well soon.

6d25e7b47616c apparmor: fix refcount leak when updating the sk_ctx
b1aea2c196077 apparmor: fix race in unix socket mediation when peer_path is used
4483efe4f2151 apparmor: fix shadowing of plabel that prevents cache from being updated

> Ryan