3.12 Backport: Fixed cipso packet validation when NETLABEL is false in kernel config, via f2e5ddcc0d12f9c4c7b254358ad245c9dddce13b