diff mbox series

[RFC,3/7] SELINUXNS: Fix initilization of the superblock security under spinlock

Message ID 20220418094552.128898-4-alexander.kozhevnikov@huawei.com (mailing list archive)
State New, archived
Delegated to: Paul Moore
Headers show
Series [RFC,1/7] LSM: Infrastructure management of the superblock | expand

Commit Message

Alexander Kozhevnikov April 18, 2022, 9:45 a.m. UTC 
From: Igor Baranov <igor.baranov@huawei.com>

After porting 3378718ef7d4a837f32c63bdfcc0b70342cdd55d,
selinux_superblock() started being called from under spinlock, along
with kzalloc(GFP_NOFS), which causes a scheduling while atomic error.
The solution is to take the call to selinux_superblock() out from under
the spinlock.

Signed-off-by: Alexander Kozhevnikov <alexander.kozhevnikov@huawei.com>
Signed-off-by: Igor Baranov <igor.baranov@huawei.com>
---
 security/selinux/hooks.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)
diff mbox series

Patch

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index a1716ce534dd..f02e31edae7c 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1408,13 +1408,6 @@  static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 	if (isec->initialized == LABEL_INITIALIZED)
 		return 0;
 
-	spin_lock(&isec->lock);
-	if (isec->initialized == LABEL_INITIALIZED)
-		goto out_unlock;
-
-	if (isec->sclass == SECCLASS_FILE)
-		isec->sclass = inode_mode_to_security_class(inode->i_mode);
-
 	sbsec = selinux_superblock(inode->i_sb);
 	if (!(sbsec->flags & SE_SBINITIALIZED)) {
 		/* Defer initialization until selinux_complete_init,
@@ -1424,9 +1417,15 @@  static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 		if (list_empty(&isec->list))
 			list_add(&isec->list, &sbsec->isec_head);
 		spin_unlock(&sbsec->isec_lock);
-		goto out_unlock;
+		return 0;
 	}
 
+	spin_lock(&isec->lock);
+	if (isec->initialized == LABEL_INITIALIZED)
+		goto out_unlock;
+
+	if (isec->sclass == SECCLASS_FILE)
+		isec->sclass = inode_mode_to_security_class(inode->i_mode);
 	sclass = isec->sclass;
 	task_sid = isec->task_sid;
 	sid = isec->sid;