2 files changed, 5 insertions, 2 deletions

diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index f2d4b6348cbc..c28b0f20ab53 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -360,7 +360,9 @@ static inline void aa_put_replacedby(struct aa_replacedby *p)
 static inline void __aa_update_replacedby(struct aa_profile *orig,
                                           struct aa_profile *new)
 {
-        struct aa_profile *tmp = rcu_dereference(orig->replacedby->profile);
+        struct aa_profile *tmp;
+        tmp = rcu_dereference_protected(orig->replacedby->profile,
+                                        mutex_is_locked(&orig->ns->lock));
         rcu_assign_pointer(orig->replacedby->profile, aa_get_profile(new));
         orig->flags |= PFLAG_INVALID;
         aa_put_profile(tmp);
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 6172509fa2b7..345bec07a27d 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -563,7 +563,8 @@ void __init aa_free_root_ns(void)
 static void free_replacedby(struct aa_replacedby *r)
 {
         if (r) {
-                aa_put_profile(rcu_dereference(r->profile));
+                /* r->profile will not be updated any more as r is dead */
+                aa_put_profile(rcu_dereference_protected(r->profile, true));
                 kzfree(r);
         }
 }