Commit 83370b31 authored by Tianyue Ren's avatar Tianyue Ren Committed by Paul Moore
Browse files

selinux: fix error initialization in inode_doinit_with_dentry() 



Mark the inode security label as invalid if we cannot find
a dentry so that we will retry later rather than marking it
initialized with the unlabeled SID.

Fixes: 9287aed2 ("selinux: Convert isec->lock into a spinlock")
Signed-off-by: default avatarTianyue Ren <rentianyue@kylinos.cn>
[PM: minor comment tweaks]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 3650b228

security/selinux/hooks.c

+16 −3
Original line number Diff line number Diff line
@@ -1451,7 +1451,13 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent 
			 * inode_doinit with a dentry, before these inodes could

			 * be used again by userspace.

			 */

			goto out;

			isec->initialized = LABEL_INVALID;

			/*

			 * There is nothing useful to jump to the "out"

			 * label, except a needless spin lock/unlock

			 * cycle.

			 */

			return 0;

		}



		rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
@@ -1507,8 +1513,15 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent 
			 * inode_doinit() with a dentry, before these inodes

			 * could be used again by userspace.

			 */

			if (!dentry)

				goto out;

			if (!dentry) {

				isec->initialized = LABEL_INVALID;

				/*

				 * There is nothing useful to jump to the "out"

				 * label, except a needless spin lock/unlock

				 * cycle.

				 */

				return 0;

			}

			rc = selinux_genfs_get_sid(dentry, sclass,

						   sbsec->flags, &sid);

			if (rc) {