UBUNTU: SAUCE: apparmor: Don't remove label on rcu callback if the label has already been removed

Double calling remove on a label does a double update of the replacedby
which is extra work and messes up tracking stats.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

security/apparmor/label.c

@@ -260,7 +260,8 @@ static void label_free_rcu(struct rcu_head *head)
 {
 	struct aa_label *l = container_of(head, struct aa_label, rcu);
 
-	(void) aa_label_remove(labels_set(l), l);
+	if (l->flags & FLAG_IN_TREE)
+		(void) aa_label_remove(labels_set(l), l);
 	label_free_switch(l);
 }