diff options
| author | Stephen Smalley <sds@tycho.nsa.gov> | 2006-06-04 02:51:30 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-06-05 12:29:16 -0700 |
| commit | ba0c19ed6a61a96d4b42b81cb19d4bc81b5f728c (patch) | |
| tree | 5e6d1774265140f1f4eddab043c90920414abe59 /security | |
| parent | 93ff66bf1ef29881dffd6fdc344555dab03cdb42 (diff) | |
| download | linux-3.10-ba0c19ed6a61a96d4b42b81cb19d4bc81b5f728c.tar.gz linux-3.10-ba0c19ed6a61a96d4b42b81cb19d4bc81b5f728c.tar.bz2 linux-3.10-ba0c19ed6a61a96d4b42b81cb19d4bc81b5f728c.zip | |
[PATCH] selinux: fix sb_lock/sb_security_lock nesting
From: Stephen Smalley <sds@tycho.nsa.gov>
Fix unsafe nesting of sb_lock inside sb_security_lock in
selinux_complete_init. Detected by the kernel locking validator.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/selinux/hooks.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 21dad415b89..90b4cdc0c94 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4422,6 +4422,7 @@ void selinux_complete_init(void) /* Set up any superblocks initialized prior to the policy load. */ printk(KERN_INFO "SELinux: Setting up existing superblocks.\n"); + spin_lock(&sb_lock); spin_lock(&sb_security_lock); next_sb: if (!list_empty(&superblock_security_head)) { @@ -4430,19 +4431,20 @@ next_sb: struct superblock_security_struct, list); struct super_block *sb = sbsec->sb; - spin_lock(&sb_lock); sb->s_count++; - spin_unlock(&sb_lock); spin_unlock(&sb_security_lock); + spin_unlock(&sb_lock); down_read(&sb->s_umount); if (sb->s_root) superblock_doinit(sb, NULL); drop_super(sb); + spin_lock(&sb_lock); spin_lock(&sb_security_lock); list_del_init(&sbsec->list); goto next_sb; } spin_unlock(&sb_security_lock); + spin_unlock(&sb_lock); } /* SELinux requires early initialization in order to label |