leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

selinux/stable-5.16 PR 20211217

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCAAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmG86EcUHHBhdWxAcGF1
 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXNtWxAAmjRflVuJNyVC23KUTGpKNSl+zFPN
 O526Mizwouv8ZO4PWo6jHr0M+UtcEAc9Tn3XFPznskOEmFWycqHSlaNXL2RiFhwR
 qSfwZEqQwZoKGb7fiD2XcHbY+OPQxixARVMQQHu77kCmY3sfz/Mjz3IAaihaEUnU
 nmZ6qpndyg2vbnOmkKJGH1WWNWEq+zKFrc/w6EeMCdOAZ455qTCMXLz0lsxDF6G5
 mYHnFlYgz4jnmU96BaN2GjWlG0/9Nrv52MAiSJzTnvBRbmhARaxQdAWaD+6vBQP6
 F/KJwwynU6ojfgKGaKBVf7pcRXkRh+c6Y0d5uA9/Xd4noEDYKlD5Vf/yyUytiuYo
 u9sUVBME+Vjk5vqPF3fZneMVx43IN73Bspii2DI/sAwllTCgayUXwB0apN3ZH1GR
 xvjHbnsuSc+WNZBRTEr3FOvM0uax2N4TcjgjIiLbmZTPjpiol0sqARKRW7vY8Ld/
 1/GSHlHvxz7ZT37ICbZreYnldXjpvdp+k4DirNb03Rc71x6+w3xInFI/jCfMXtzS
 8VuA33m1q420DRCFgdY4KxYjl5dAbcFZDpU2FILH3NvduuYGN8Qbh24BbToNBwUZ
 U7Hojk8EAWO7+YpGpEOYZc9hcGH2GemvyPLt2m7AO9T4a81f8IHBBvRTMGi/R/lN
 r1PyoZR3GMkpHko=
 =1nOw
 -----END PGP SIGNATURE-----

Merge tag 'selinux-pr-20211217' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux

Pull selinux fix from Paul Moore:
 "Another small SELinux fix for v5.16 to ensure that we don't block on
  memory allocations while holding a spinlock.

  This passes all our tests without problem"

* tag 'selinux-pr-20211217' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: fix sleeping function called from invalid context
This commit is contained in:
Linus Torvalds 2021-12-17 12:03:14 -08:00
commit f1f05ef383
1 changed files with 19 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
security/selinux/hooks.c
View File

@ -611,10 +611,11 @@ static int bad_option(struct superblock_security_struct *sbsec, char flag,
return 0;
}
static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
static int parse_sid(struct super_block *sb, const char *s, u32 *sid,
gfp_t gfp)
{
int rc = security_context_str_to_sid(&selinux_state, s,
sid, GFP_KERNEL);
sid, gfp);
if (rc)
pr_warn("SELinux: security_context_str_to_sid"
"(%s) failed for (dev %s, type %s) errno=%d\n",
@ -685,7 +686,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
*/
if (opts) {
if (opts->fscontext) {
rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
rc = parse_sid(sb, opts->fscontext, &fscontext_sid,
GFP_KERNEL);
if (rc)
goto out;
if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
@ -694,7 +696,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
sbsec->flags |= FSCONTEXT_MNT;
}
if (opts->context) {
rc = parse_sid(sb, opts->context, &context_sid);
rc = parse_sid(sb, opts->context, &context_sid,
GFP_KERNEL);
if (rc)
goto out;
if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
@ -703,7 +706,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
sbsec->flags |= CONTEXT_MNT;
}
if (opts->rootcontext) {
rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid,
GFP_KERNEL);
if (rc)
goto out;
if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
@ -712,7 +716,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
sbsec->flags |= ROOTCONTEXT_MNT;
}
if (opts->defcontext) {
rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
rc = parse_sid(sb, opts->defcontext, &defcontext_sid,
GFP_KERNEL);
if (rc)
goto out;
if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
@ -2702,14 +2707,14 @@ static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
if (opts->fscontext) {
rc = parse_sid(sb, opts->fscontext, &sid);
rc = parse_sid(sb, opts->fscontext, &sid, GFP_NOWAIT);
if (rc)
return 1;
if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
return 1;
}
if (opts->context) {
rc = parse_sid(sb, opts->context, &sid);
rc = parse_sid(sb, opts->context, &sid, GFP_NOWAIT);
if (rc)
return 1;
if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
@ -2719,14 +2724,14 @@ static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
struct inode_security_struct *root_isec;
root_isec = backing_inode_security(sb->s_root);
rc = parse_sid(sb, opts->rootcontext, &sid);
rc = parse_sid(sb, opts->rootcontext, &sid, GFP_NOWAIT);
if (rc)
return 1;
if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
return 1;
}
if (opts->defcontext) {
rc = parse_sid(sb, opts->defcontext, &sid);
rc = parse_sid(sb, opts->defcontext, &sid, GFP_NOWAIT);
if (rc)
return 1;
if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
@ -2749,14 +2754,14 @@ static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
return 0;
if (opts->fscontext) {
rc = parse_sid(sb, opts->fscontext, &sid);
rc = parse_sid(sb, opts->fscontext, &sid, GFP_KERNEL);
if (rc)
return rc;
if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
goto out_bad_option;
}
if (opts->context) {
rc = parse_sid(sb, opts->context, &sid);
rc = parse_sid(sb, opts->context, &sid, GFP_KERNEL);
if (rc)
return rc;
if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
@ -2765,14 +2770,14 @@ static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
if (opts->rootcontext) {
struct inode_security_struct *root_isec;
root_isec = backing_inode_security(sb->s_root);
rc = parse_sid(sb, opts->rootcontext, &sid);
rc = parse_sid(sb, opts->rootcontext, &sid, GFP_KERNEL);
if (rc)
return rc;
if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
goto out_bad_option;
}
if (opts->defcontext) {
rc = parse_sid(sb, opts->defcontext, &sid);
rc = parse_sid(sb, opts->defcontext, &sid, GFP_KERNEL);
if (rc)
return rc;
if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))