This is a note to let you know that I've just added the patch titled
selinux: fix error initialization in inode_doinit_with_dentry()
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
selinux-fix-error-initialization-in-inode_doinit_with_dentry.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 83370b31a915493231e5b9addc72e4bef69f8d31 Mon Sep 17 00:00:00 2001
From: Tianyue Ren <rentianyue@xxxxxxxxxx>
Date: Fri, 9 Oct 2020 09:36:30 +0800
Subject: selinux: fix error initialization in inode_doinit_with_dentry()
From: Tianyue Ren <rentianyue@xxxxxxxxxx>
commit 83370b31a915493231e5b9addc72e4bef69f8d31 upstream.
Mark the inode security label as invalid if we cannot find
a dentry so that we will retry later rather than marking it
initialized with the unlabeled SID.
Fixes: 9287aed2ad1f ("selinux: Convert isec->lock into a spinlock")
Signed-off-by: Tianyue Ren <rentianyue@xxxxxxxxxx>
[PM: minor comment tweaks]
Signed-off-by: Paul Moore <paul@xxxxxxxxxxxxxx>
Signed-off-by: Alexander Grund <theflamefire89@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
security/selinux/hooks.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1450,7 +1450,13 @@ static int inode_doinit_with_dentry(stru
* inode_doinit with a dentry, before these inodes could
* be used again by userspace.
*/
- goto out;
+ isec->initialized = LABEL_INVALID;
+ /*
+ * There is nothing useful to jump to the "out"
+ * label, except a needless spin lock/unlock
+ * cycle.
+ */
+ return 0;
}
len = INITCONTEXTLEN;
@@ -1558,8 +1564,15 @@ static int inode_doinit_with_dentry(stru
* inode_doinit() with a dentry, before these inodes
* could be used again by userspace.
*/
- if (!dentry)
- goto out;
+ if (!dentry) {
+ isec->initialized = LABEL_INVALID;
+ /*
+ * There is nothing useful to jump to the "out"
+ * label, except a needless spin lock/unlock
+ * cycle.
+ */
+ return 0;
+ }
rc = selinux_genfs_get_sid(dentry, sclass,
sbsec->flags, &sid);
dput(dentry);
Patches currently in stable-queue which might be from rentianyue@xxxxxxxxxx are
queue-4.9/selinux-fix-error-initialization-in-inode_doinit_with_dentry.patch
