The inner block in aa_unix_file_perm() re-declares plabel, shadowing the outer variable that is released at the out label. The reference taken by aa_get_label_rcu() is thus lost when the block exits, and aa_put_label() at out is a no-op on the still NULL outer plabel, leaking one label per permission check on a non-filesystem unix socket. Drop the shadowing declaration so the outer plabel is used and released. Fixes: 88fec3526e84 ("apparmor: make sure unix socket labeling is correctly updated.") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- security/apparmor/af_unix.c | 1 - 1 file changed, 1 deletion(-) diff --git a/security/apparmor/af_unix.c b/security/apparmor/af_unix.c index fdb4a9f212c3..ecb40cfe7e14 100644 --- a/security/apparmor/af_unix.c +++ b/security/apparmor/af_unix.c @@ -758,7 +758,6 @@ int aa_unix_file_perm(const struct cred *subj_cred, struct aa_label *label, unix_fs_perm(op, request, subj_cred, label, is_unix_fs(peer_sk) ? &peer_path : NULL)); } else if (!is_sk_fs) { - struct aa_label *plabel; struct aa_sk_ctx *pctx = aa_sock(peer_sk); rcu_read_lock(); -- 2.34.1