Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b127125d authored by Al Viro's avatar Al Viro
Browse files

fix breakage caused by d_find_alias() semantics change 



"VFS: don't keep disconnected dentries on d_anon" had a non-trivial
side-effect - d_unhashed() now returns true for those dentries,
making d_find_alias() skip them altogether.  For most of its callers
that's fine - we really want a connected alias there.  However,
there is a codepath where we relied upon picking such aliases
if nothing else could be found - selinux delayed initialization
of contexts for inodes on already mounted filesystems used to
rely upon that.

Cc: stable@kernel.org # f1ee6162 "VFS: don't keep disconnected dentries on d_anon"
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 79f546a6

security/selinux/hooks.c

+16 −4
Original line number Diff line number Diff line
@@ -1568,8 +1568,15 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent 
			/* Called from d_instantiate or d_splice_alias. */

			dentry = dget(opt_dentry);

		} else {

			/* Called from selinux_complete_init, try to find a dentry. */

			/*

			 * Called from selinux_complete_init, try to find a dentry.

			 * Some filesystems really want a connected one, so try

			 * that first.  We could split SECURITY_FS_USE_XATTR in

			 * two, depending upon that...

			 */

			dentry = d_find_alias(inode);

			if (!dentry)

				dentry = d_find_any_alias(inode);

		}

		if (!dentry) {

			/*
@@ -1674,14 +1681,19 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent 
		if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {

			/* We must have a dentry to determine the label on

			 * procfs inodes */

			if (opt_dentry)

			if (opt_dentry) {

				/* Called from d_instantiate or

				 * d_splice_alias. */

				dentry = dget(opt_dentry);

			else

			} else {

				/* Called from selinux_complete_init, try to

				 * find a dentry. */

				 * find a dentry.  Some filesystems really want

				 * a connected one, so try that first.

				 */

				dentry = d_find_alias(inode);

				if (!dentry)

					dentry = d_find_any_alias(inode);

			}

			/*

			 * This can be hit on boot when a file is accessed

			 * before the policy is loaded.  When we load policy we