selinux: fix missing dput() before selinuxfs unmount

fd40ffc7 · Stephen Smalley <[email protected]> · 2018-04-09 14:36:05 -04:00

Commit 0619f0f5e36f ("selinux: wrap selinuxfs state") triggers a BUG
when SELinux is runtime-disabled (i.e. systemd or equivalent disables
SELinux before initial policy load via /sys/fs/selinux/disable based on
/etc/selinux/config SELINUX=disabled).

This does not manifest if SELinux is disabled via kernel command line
argument or if SELinux is enabled (permissive or enforcing).

Before:
  SELinux:  Disabled at runtime.
  BUG: Dentry 000000006d77e5c7{i=17,n=null}  still in use (1) [unmount of selinuxfs selinuxfs]

After:
  SELinux:  Disabled at runtime.

Fixes: 0619f0f5e36f ("selinux: wrap selinuxfs state")
Reported-by: Tetsuo Handa <[email protected]>
Reported-by: Dmitry Vyukov <[email protected]>
Signed-off-by: Stephen Smalley <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Commit: fd40ffc72e2f74c7db61e400903e7d50a88bc0b0
Parents: d8312a3f

Changes

1 files changed · +1 −0

File	Status	Add	Del	Content
security/selinux/selinuxfs.c	modified	+1	−0	View file

security/selinux/selinuxfs.c

View file

diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 4be683e..2451603 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -2061,6 +2061,7 @@ __initcall(init_sel_fs);
 void exit_sel_fs(void)
 {
 	sysfs_remove_mount_point(fs_kobj, "selinux");
+	dput(selinux_null.dentry);
 	kern_unmount(selinuxfs_mount);
 	unregister_filesystem(&sel_fs_type);
 }