The unlocked check in update_sk_ctx() can see peer_lastupdate set before peer is initialized, passing NULL to aa_label_is_subset(). The earlier NULL checks only cover accesses under the socket lock. Check for NULL and refresh the cache instead. Fixes: 88fec3526e84 ("apparmor: make sure unix socket labeling is correctly updated.") Link: https://lore.kernel.org/all/20260824155822.9214-1-maxime.belair@canonical.com/ Cc: stable@vger.kernel.org Signed-off-by: Emanuele Rocca --- security/apparmor/af_unix.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/apparmor/af_unix.c b/security/apparmor/af_unix.c index d04d9cd268aa..b95959806303 100644 --- a/security/apparmor/af_unix.c +++ b/security/apparmor/af_unix.c @@ -657,9 +657,10 @@ static void update_sk_ctx(struct sock *sk, struct aa_label *label, bool update_sk; rcu_read_lock(); + old = rcu_dereference(ctx->peer); update_sk = (plabel && (plabel != rcu_access_pointer(ctx->peer_lastupdate) || - !aa_label_is_subset(plabel, rcu_dereference(ctx->peer)))) || + !old || !aa_label_is_subset(plabel, old))) || !__aa_subj_label_is_cached(label, rcu_dereference(ctx->label)); rcu_read_unlock(); if (!update_sk) -- 2.55.0