Signed-off-by: Ryan Lee <[email protected]>
---
security/apparmor/file.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index c9d55fe1086f..f42e31e8541b 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -653,7 +653,12 @@ int aa_file_perm(const char *op, const struct cred
*subj_cred,
goto done;
}
- /* slow path - revalidate access */
+ /* slow path - revalidate access
+ * Because flabel was previously obtained under RCU, it might be due
+ * for cleanup once the RCU grace period ends. Thus, to mediate against
+ * it on the slow path, we always need to keep a refcount after exiting
+ * the RCU read-side section, and we cannot use condref optimizations.
+ */
flabel = aa_get_newest_label(flabel);
rcu_read_unlock();
--
2.43.0
