Paul Moore 42d64e1add selinux: correct locking in selinux_netlbl_socket_connect) ... The SELinux/NetLabel glue code has a locking bug that affects systems with NetLabel enabled, see the kernel error message below. This patch corrects this problem by converting the bottom half socket lock to a more conventional, and correct for this call-path, lock_sock() call. =============================== [ INFO: suspicious RCU usage. ] 3.11.0-rc3+ #19 Not tainted ------------------------------- net/ipv4/cipso_ipv4.c:1928 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 2 locks held by ping/731: #0: (slock-AF_INET/1){+.-...}, at: [...] selinux_netlbl_socket_connect #1: (rcu_read_lock){.+.+..}, at: [<...>] netlbl_conn_setattr stack backtrace: CPU: 1 PID: 731 Comm: ping Not tainted 3.11.0-rc3+ #19 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 0000000000000001 ffff88006f659d28 ffffffff81726b6a ffff88003732c500 ffff88006f659d58 ffffffff810e4457 ffff88006b845a00 0000000000000000 000000000000000c ffff880075aa2f50 ffff88006f659d90 ffffffff8169bec7 Call Trace: [<ffffffff81726b6a>] dump_stack+0x54/0x74 [<ffffffff810e4457>] lockdep_rcu_suspicious+0xe7/0x120 [<ffffffff8169bec7>] cipso_v4_sock_setattr+0x187/0x1a0 [<ffffffff8170f317>] netlbl_conn_setattr+0x187/0x190 [<ffffffff8170f195>] ? netlbl_conn_setattr+0x5/0x190 [<ffffffff8131ac9e>] selinux_netlbl_socket_connect+0xae/0xc0 [<ffffffff81303025>] selinux_socket_connect+0x135/0x170 [<ffffffff8119d127>] ? might_fault+0x57/0xb0 [<ffffffff812fb146>] security_socket_connect+0x16/0x20 [<ffffffff815d3ad3>] SYSC_connect+0x73/0x130 [<ffffffff81739a85>] ? sysret_check+0x22/0x5d [<ffffffff810e5e2d>] ? trace_hardirqs_on_caller+0xfd/0x1c0 [<ffffffff81373d4e>] ? trace_hardirqs_on_thunk+0x3a/0x3f [<ffffffff815d52be>] SyS_connect+0xe/0x10 [<ffffffff81739a59>] system_call_fastpath+0x16/0x1b Cc: stable@vger.kernel.org Signed-off-by: Paul Moore <pmoore@redhat.com>		2013-09-26 17:00:46 -04:00
..
include	Merge git://git.infradead.org/users/eparis/selinux	2013-09-18 13:52:20 -04:00
ss	Merge git://git.infradead.org/users/eparis/selinux	2013-09-18 13:52:20 -04:00
.gitignore	SELinux: add .gitignore files for dynamic classes	2009-10-24 09:42:27 +08:00
avc.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
exports.c	selinux: sparse fix: include selinux.h in exports.c	2011-09-09 16:56:32 -07:00
hooks.c	Merge git://git.infradead.org/users/eparis/selinux	2013-09-18 13:52:20 -04:00
Kconfig	selinux: Deprecate and schedule the removal of the the compat_net functionality	2008-12-31 12:54:11 -05:00
Makefile	selinux: change to new flag variable	2010-10-21 10:12:40 +11:00
netif.c	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
netlabel.c	selinux: correct locking in selinux_netlbl_socket_connect)	2013-09-26 17:00:46 -04:00
netlink.c	selinux: replace obsolete NLMSG_* with type safe nlmsg_*	2013-03-28 14:25:49 -04:00
netnode.c	selinux: fix problems in netnode when BUG() is compiled out	2013-07-25 13:03:27 -04:00
netport.c	SELinux: avc: remove the useless fields in avc_add_callback	2012-04-09 12:23:44 -04:00
nlmsgtab.c	bridge: update selinux perm table for RTM_NEWMDB and RTM_DELMDB	2012-12-15 17:14:38 -08:00
selinuxfs.c	Add SELinux policy capability for always checking packet and peer classes.	2013-07-25 13:03:38 -04:00
xfrm.c	selinux: Use kmemdup instead of kmalloc + memcpy	2013-09-26 15:52:13 -04:00