Re: [PATCH] apparmor: Fix label reference leak in aa_unix_file_perm()

[John Johansen]

On 9/17/26 12:19, Ryan Lee wrote:
> On Thu, Sep 17, 2026 at 11:59 AM Wentao Liang <vulab@xxxxxxxxxxx> wrote:
> > The inner block in aa_unix_file_perm() re-declares plabel, shadowing the
> > outer variable that is released at the out label. The reference taken by
> > aa_get_label_rcu() is thus lost when the block exits, and aa_put_label()
> > at out is a no-op on the still NULL outer plabel, leaking one label per
> > permission check on a non-filesystem unix socket.
> >
> > Drop the shadowing declaration so the outer plabel is used and released.
> >
> > Fixes: 88fec3526e84 ("apparmor: make sure unix socket labeling is correctly updated.")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> > ---
> >   security/apparmor/af_unix.c | 1 -
> >   1 file changed, 1 deletion(-)
> >
> > diff --git a/security/apparmor/af_unix.c b/security/apparmor/af_unix.c
> > index fdb4a9f212c3..ecb40cfe7e14 100644
> > --- a/security/apparmor/af_unix.c
> > +++ b/security/apparmor/af_unix.c
> > @@ -758,7 +758,6 @@ int aa_unix_file_perm(const struct cred *subj_cred, struct aa_label *label,
> >                             unix_fs_perm(op, request, subj_cred, label,
> >                                          is_unix_fs(peer_sk) ? &peer_path : NULL));
> >          } else if (!is_sk_fs) {
> > -               struct aa_label *plabel;
> >                  struct aa_sk_ctx *pctx = aa_sock(peer_sk);
> >
> >                  rcu_read_lock();
> > --
> > 2.34.1
>
> NACK: this exact patch has been proposed before, and unfortunately
> exposes an additional latent bug around plabel handling that results
> in a use-after-free if the shadowed declaration is removed without
> additional fixes.
>
> I can try to dig out the relevant exchange from the AppArmor mailing
> list later, if you'd be interested.
The series Ryan is referring to is in Linus's tree, so you should see the
fix rolling out to stable kernels as well soon.

6d25e7b47616c apparmor: fix refcount leak when updating the sk_ctx
b1aea2c196077 apparmor: fix race in unix socket mediation when peer_path is used
4483efe4f2151 apparmor: fix shadowing of plabel that prevents cache from being updated

> Ryan