From 45ff74bd5a009ab8f9648531fa11fce55b9a67fd Mon Sep 17 00:00:00 2001
From: John Johansen <john.johansen@canonical.com>
Date: Tue, 26 Jun 2018 20:19:19 -0700
Subject: [PATCH 3/3] apparmor: fix use after free in sk_peer_label
References: bsc#1112770
Patch-mainline: never, apparmor 2.x compatibility fix
BugLink: http://bugs.launchpad.net/bugs/1778646
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
---
security/apparmor/lsm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1018,7 +1018,7 @@ static struct aa_label *sk_peer_label(st
struct aa_sk_ctx *ctx = SK_CTX(sk);
if (ctx->peer)
- return ctx->peer;
+ return aa_get_label(ctx->peer);
return ERR_PTR(-ENOPROTOOPT);
}
@@ -1064,6 +1064,7 @@ out:
}
+ aa_put_label(peer);
done:
end_current_label_crit_section(label);