[PATCH] apparmor: fix race on NULL ctx->peer in update_sk_ctx()

[Emanuele Rocca <emanuele.rocca@arm.com>]

The unlocked check in update_sk_ctx() can see peer_lastupdate set before
peer is initialized, passing NULL to aa_label_is_subset().

The earlier NULL checks only cover accesses under the socket lock.
Check for NULL and refresh the cache instead.

Fixes: 88fec3526e84 ("apparmor: make sure unix socket labeling is correctly updated.")
Link: https://lore.kernel.org/all/20260824155822.9214-1-maxime.belair@canonical.com/
Cc: stable@vger.kernel.org
Signed-off-by: Emanuele Rocca <emanuele.rocca@arm.com>
---
 security/apparmor/af_unix.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/security/apparmor/af_unix.c b/security/apparmor/af_unix.c
index d04d9cd268aa..b95959806303 100644
--- a/security/apparmor/af_unix.c
+++ b/security/apparmor/af_unix.c
@@ -657,9 +657,10 @@ static void update_sk_ctx(struct sock *sk, struct aa_label *label,
 	bool update_sk;
 
 	rcu_read_lock();
+	old = rcu_dereference(ctx->peer);
 	update_sk = (plabel &&
 		     (plabel != rcu_access_pointer(ctx->peer_lastupdate) ||
-		      !aa_label_is_subset(plabel, rcu_dereference(ctx->peer)))) ||
+		      !old || !aa_label_is_subset(plabel, old))) ||
 	  !__aa_subj_label_is_cached(label, rcu_dereference(ctx->label));
 	rcu_read_unlock();
 	if (!update_sk)
-- 
2.55.0