SELinux: don't BUG if fs reuses a superblock
Subsystems (3)
PATCH 1/1 SELinux: don't BUG if fs reuses a superblock
I (wrongly) assumed that nfs_xdev_get_sb() would not ever share a superblock and so cloning mount options would always be correct. Turns out that isn't the case and we could fall over a BUG_ON() that wasn't a BUG at all. Since there is little we can do to reconcile different mount options this patch just leaves the sb alone and the first set of options wins.
---
security/selinux/hooks.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-)
security/selinux/hooks.c +4 -4
@@ -760,13 +760,13 @@ static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,* this early in the boot process. */ BUG_ON (!ss_initialized); -/* this might go away sometime down the line if there is a new user -* of clone, but for now, nfs better not get here... */ -BUG_ON (newsbsec->initialized); -/* how can we clone if the old one wasn't set up?? */ BUG_ON (!oldsbsec->initialized); +/* if fs is reusing a sb, just let its options stand... */ +if (newsbsec->initialized) +return ; +mutex_lock (&newsbsec->lock); newsbsec->flags = oldsbsec->flags;
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
A message that is not in the archive (sent off-list or not yet received): 1207764515.3070.39.camel-bi+AKbBUZKY6gyzm1THtWbp2dZbC/[email protected]
Stephen Smalley
Acked-byQuoted 8 lines · Eric Paris
I (wrongly) assumed that
nfs_xdev_get_sb()would not ever share a superblock and so cloning mount options would always be correct. Turns out that isn't the case and we could fall over aBUG_ON()that wasn't a BUG at all. Since there is little we can do to reconcile different mount options this patch just leaves the sb alone and the first set of options wins.Signed-off-by Eric Paris <[email protected]>
This is a bug fix - should go into 2.6.25.
Quoted 29 lines
---
security/selinux/hooks.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-)security/selinux/hooks.c +4
-4@@ -760,13 +760,13 @@ static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,* this early in the boot process. */ BUG_ON (!ss_initialized); -/* this might go away sometime down the line if there is a new user -* of clone, but for now, nfs better not get here... */ -BUG_ON (newsbsec->initialized); -/* how can we clone if the old one wasn't set up?? */ BUG_ON (!oldsbsec->initialized); +/* if fs is reusing a sb, just let its options stand... */ +if (newsbsec->initialized) +return ; +mutex_lock (&newsbsec->lock); newsbsec->flags = oldsbsec->flags;
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 8 lines · Eric Paris
I (wrongly) assumed that
nfs_xdev_get_sb()would not ever share a superblock and so cloning mount options would always be correct. Turns out that isn't the case and we could fall over aBUG_ON()that wasn't a BUG at all. Since there is little we can do to reconcile different mount options this patch just leaves the sb alone and the first set of options wins.Signed-off-by Eric Paris <[email protected]>
Ack...
Quoted 29 lines
---
security/selinux/hooks.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-)security/selinux/hooks.c +4
-4@@ -760,13 +760,13 @@ static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,* this early in the boot process. */ BUG_ON (!ss_initialized); -/* this might go away sometime down the line if there is a new user -* of clone, but for now, nfs better not get here... */ -BUG_ON (newsbsec->initialized); -/* how can we clone if the old one wasn't set up?? */ BUG_ON (!oldsbsec->initialized); +/* if fs is reusing a sb, just let its options stand... */ +if (newsbsec->initialized) +return ; +mutex_lock (&newsbsec->lock); newsbsec->flags = oldsbsec->flags;
A message that is not in the archive (sent off-list or not yet received): 1207773091.11881.27.camel-rJ7iovZKK19ZJLDQqaL3InhyD016LWXt@public.gmane.org
Quoted 3 lines · Trond Myklebust
Quoted 1 line
Signed-off-by Eric Paris <[email protected]>Ack...
Applied and pushed to Linus.
Signature · 7 lines
James Morris <[email protected]> -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.