diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index f1fc48e72d0e..99bc4f946d15 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -558,6 +558,9 @@ static int unpack_strs_table(struct aa_ext *e, const char *name, bool multi,
 			/* aa_unpack_strdup verifies that the last character is
 			 * null termination byte.
 			 */
+			/* publish before validating; the error path frees it */
+			table[i].strs = str;
+			table[i].size = size2;
 			c = process_strs_entry(str, size2, multi);
 			if (c <= 0) {
 				AA_DEBUG(DEBUG_UNPACK, "process_strs %d i %d pos %ld",
@@ -570,9 +573,7 @@ static int unpack_strs_table(struct aa_ext *e, const char *name, bool multi,
 				/* fail - all other cases with embedded \0 */
 				goto fail;
 			}
-			table[i].strs = str;
 			table[i].count = c;
-			table[i].size = size2;
 		}
 		if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 			goto fail;