Skip to content

kernel: selinux: rules: Micro-optimize get_policydb() and fix illegal RCU lock usage in handle_sepolicy() #2695

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 13, 2025
Merged

kernel: selinux: rules: Micro-optimize get_policydb() and fix illegal RCU lock usage in handle_sepolicy() #2695

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
09a6a31
kernel: selinux: rules: Fix illegal RCU lock usage in handle_sepolicy()
Tashar02 Jul 31, 2025
f0a9b35
kernel: selinux: rules: Remove unnecessary RCU dereference in get_pol…
Tashar02 Jul 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions kernel/selinux/rules.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
static struct policydb *get_policydb(void)
{
struct policydb *db;
struct selinux_policy *policy = rcu_dereference(selinux_state.policy);
struct selinux_policy *policy = selinux_state.policy;
db = &policy->policydb;
return db;
}
Expand Down Expand Up @@ -189,6 +189,8 @@ static void reset_avc_cache()

int handle_sepolicy(unsigned long arg3, void __user *arg4)
{
struct policydb *db;

if (!arg4) {
return -1;
}
Expand All @@ -206,9 +208,9 @@ int handle_sepolicy(unsigned long arg3, void __user *arg4)
u32 cmd = data.cmd;
u32 subcmd = data.subcmd;

rcu_read_lock();
mutex_lock(&ksu_rules);

struct policydb *db = get_policydb();
db = get_policydb();

int ret = -1;
if (cmd == CMD_NORMAL_PERM) {
Expand Down Expand Up @@ -458,7 +460,7 @@ int handle_sepolicy(unsigned long arg3, void __user *arg4)
}

exit:
rcu_read_unlock();
mutex_unlock(&ksu_rules);

// only allow and xallow needs to reset avc cache, but we cannot do that because
// we are in atomic context. so we just reset it every time.
Expand Down
Loading