[apparmor] [PATCH] apparmor: Fix label reference leak in aa_unix_file_perm()

[Wentao Liang]

The inner block in aa_unix_file_perm() re-declares plabel, shadowing the
outer variable that is released at the out label. The reference taken by
aa_get_label_rcu() is thus lost when the block exits, and aa_put_label()
at out is a no-op on the still NULL outer plabel, leaking one label per
permission check on a non-filesystem unix socket.

Drop the shadowing declaration so the outer plabel is used and released.

Fixes: 88fec3526e84 ("apparmor: make sure unix socket labeling is correctly 
updated.")
Cc: sta...@vger.kernel.org
Signed-off-by: Wentao Liang <vu...@iscas.ac.cn>
---
 security/apparmor/af_unix.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/security/apparmor/af_unix.c b/security/apparmor/af_unix.c
index fdb4a9f212c3..ecb40cfe7e14 100644
--- a/security/apparmor/af_unix.c
+++ b/security/apparmor/af_unix.c
@@ -758,7 +758,6 @@ int aa_unix_file_perm(const struct cred *subj_cred, struct 
aa_label *label,
                           unix_fs_perm(op, request, subj_cred, label,
                                        is_unix_fs(peer_sk) ? &peer_path : 
NULL));
        } else if (!is_sk_fs) {
-               struct aa_label *plabel;
                struct aa_sk_ctx *pctx = aa_sock(peer_sk);
 
                rcu_read_lock();
-- 
2.34.1