apparmor: fix refcount bug in profile replacement

commit dcda617a0c5160c73e0aa02813c871339ea08004 upstream.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 705c2879d3a94a79e10d1190468483c2f9d7192a..222052f64e2cc127b0a013165cb04f2c0b122160 100644 (file)
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -1189,12 +1189,12 @@ ssize_t aa_replace_profiles(void *udata, size_t size, bool noreplace)
                                aa_get_profile(newest);
                                aa_put_profile(parent);
                                rcu_assign_pointer(ent->new->parent, newest);
-                       } else
-                               aa_put_profile(newest);
+                       }
                        /* aafs interface uses replacedby */
                        rcu_assign_pointer(ent->new->replacedby->profile,
                                           aa_get_profile(ent->new));
                        __list_add_profile(&parent->base.profiles, ent->new);
+                       aa_put_profile(newest);
                } else {
                        /* aafs interface uses replacedby */
                        rcu_assign_pointer(ent->new->replacedby->profile,