diff options
| author | Tianyue Ren <rentianyue@kylinos.cn> | 2020-10-09 09:36:30 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-12-30 11:25:50 +0100 |
| commit | bd7223dda090c9246b290a0b901c112d6484466a (patch) | |
| tree | dd479dc9aa91be2876bb740d987942277bcd3066 /security | |
| parent | f2b081c76ea8fbaf11d8c01dc12fac6416cb9cf7 (diff) | |
| download | linux-stable-bd7223dda090c9246b290a0b901c112d6484466a.tar.gz linux-stable-bd7223dda090c9246b290a0b901c112d6484466a.tar.bz2 linux-stable-bd7223dda090c9246b290a0b901c112d6484466a.zip | |
selinux: fix error initialization in inode_doinit_with_dentry()
[ Upstream commit 83370b31a915493231e5b9addc72e4bef69f8d31 ]
Mark the inode security label as invalid if we cannot find
a dentry so that we will retry later rather than marking it
initialized with the unlabeled SID.
Fixes: 9287aed2ad1f ("selinux: Convert isec->lock into a spinlock")
Signed-off-by: Tianyue Ren <rentianyue@kylinos.cn>
[PM: minor comment tweaks]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/selinux/hooks.c | 19 |
1 files changed, 16 insertions, 3 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 250b725f5754..02afe52a55d0 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1618,7 +1618,13 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent * inode_doinit with a dentry, before these inodes could * be used again by userspace. */ - goto out; + isec->initialized = LABEL_INVALID; + /* + * There is nothing useful to jump to the "out" + * label, except a needless spin lock/unlock + * cycle. + */ + return 0; } len = INITCONTEXTLEN; @@ -1733,8 +1739,15 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent * inode_doinit() with a dentry, before these inodes * could be used again by userspace. */ - if (!dentry) - goto out; + if (!dentry) { + isec->initialized = LABEL_INVALID; + /* + * There is nothing useful to jump to the "out" + * label, except a needless spin lock/unlock + * cycle. + */ + return 0; + } rc = selinux_genfs_get_sid(dentry, sclass, sbsec->flags, &sid); dput(dentry); |