On Thu, Sep 17, 2026 at 11:59 AM Wentao Liang <[email protected]> wrote: > > The inner block in aa_unix_file_perm() re-declares plabel, shadowing the > outer variable that is released at the out label. The reference taken by > aa_get_label_rcu() is thus lost when the block exits, and aa_put_label() > at out is a no-op on the still NULL outer plabel, leaking one label per > permission check on a non-filesystem unix socket. > > Drop the shadowing declaration so the outer plabel is used and released. > > Fixes: 88fec3526e84 ("apparmor: make sure unix socket labeling is correctly > updated.") > Cc: [email protected] > Signed-off-by: Wentao Liang <[email protected]> > --- > security/apparmor/af_unix.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/security/apparmor/af_unix.c b/security/apparmor/af_unix.c > index fdb4a9f212c3..ecb40cfe7e14 100644 > --- a/security/apparmor/af_unix.c > +++ b/security/apparmor/af_unix.c > @@ -758,7 +758,6 @@ int aa_unix_file_perm(const struct cred *subj_cred, > struct aa_label *label, > unix_fs_perm(op, request, subj_cred, label, > is_unix_fs(peer_sk) ? &peer_path : > NULL)); > } else if (!is_sk_fs) { > - struct aa_label *plabel; > struct aa_sk_ctx *pctx = aa_sock(peer_sk); > > rcu_read_lock(); > -- > 2.34.1 > >
NACK: this exact patch has been proposed before, and unfortunately exposes an additional latent bug around plabel handling that results in a use-after-free if the shadowed declaration is removed without additional fixes. I can try to dig out the relevant exchange from the AppArmor mailing list later, if you'd be interested. Ryan
