From: Casey Schaufler <casey(a)schaufler-ca.com>
The 5.1 mount system rework changed the smackfsdef mount option
to smackfsdefault. This fixes the regression by making smackfsdef
treated the same way as smackfsdefault.
Also fix the smack_param_specs[] to have "smack" prefixes on all the names.
This isn't visible to a user unless they either:
(a) Try to mount a filesystem that's converted to the internal mount API
and that implements the ->parse_monolithic() context operation - and
only then if they call security_fs_context_parse_param() rather than
security_sb_eat_lsm_opts().
There are no examples of this upstream yet, but nfs will probably want
to do this for nfs2 or nfs3.
(b) Use fsconfig() to configure the filesystem - in which case
security_fs_context_parse_param() will be called.
This issue is that smack_sb_eat_lsm_opts() checks for the "smack" prefix on
the options, but smack_fs_context_parse_param() does not.
Fixes: c3300aaf95fb ("smack: get rid of match_token()")
Fixes: 2febd254adc4 ("smack: Implement filesystem context security hooks")
Cc: stable(a)vger.kernel.org
Reported-by: Jose Bollo <jose.bollo(a)iot.bzh>
Signed-off-by: Casey Schaufler <casey(a)schaufler-ca.com>
Signed-off-by: David Howells <dhowells(a)redhat.com>
Tested-by: Casey Schaufler <casey(a)schaufler-ca.com>
---
security/smack/smack_lsm.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 0de725f88bed..d99450b4f511 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -68,6 +68,7 @@ static struct {
int len;
int opt;
} smk_mount_opts[] = {
+ {"smackfsdef", sizeof("smackfsdef") - 1, Opt_fsdefault},
A(fsdefault), A(fsfloor), A(fshat), A(fsroot), A(fstransmute)
};
#undef A
@@ -682,11 +683,12 @@ static int smack_fs_context_dup(struct fs_context *fc,
}
static const struct fs_parameter_spec smack_param_specs[] = {
- fsparam_string("fsdefault", Opt_fsdefault),
- fsparam_string("fsfloor", Opt_fsfloor),
- fsparam_string("fshat", Opt_fshat),
- fsparam_string("fsroot", Opt_fsroot),
- fsparam_string("fstransmute", Opt_fstransmute),
+ fsparam_string("smackfsdef", Opt_fsdefault),
+ fsparam_string("smackfsdefault", Opt_fsdefault),
+ fsparam_string("smackfsfloor", Opt_fsfloor),
+ fsparam_string("smackfshat", Opt_fshat),
+ fsparam_string("smackfsroot", Opt_fsroot),
+ fsparam_string("smackfstransmute", Opt_fstransmute),
{}
};
> On Jun 15, 2019, at 3:15 PM, Sasha Levin <sashal(a)kernel.org> wrote:
>
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: ff3cc952d3f0 resource: Add remove_resource interface.
>
> The bot has tested the following trees: v5.1.9, v4.19.50, v4.14.125, v4.9.181.
>
> v5.1.9: Build OK!
> v4.19.50: Failed to apply! Possible dependencies:
> 010a93bf97c7 ("resource: Fix find_next_iomem_res() iteration issue")
> a98959fdbda1 ("resource: Include resource end in walk_*() interfaces")
>
> v4.14.125: Failed to apply! Possible dependencies:
> 010a93bf97c7 ("resource: Fix find_next_iomem_res() iteration issue")
> 0e4c12b45aa8 ("x86/mm, resource: Use PAGE_KERNEL protection for ioremap of memory pages")
> 1d2e733b13b4 ("resource: Provide resource struct in resource walk callback")
> 4ac2aed837cb ("resource: Consolidate resource walking code")
> a98959fdbda1 ("resource: Include resource end in walk_*() interfaces")
>
> v4.9.181: Failed to apply! Possible dependencies:
> 010a93bf97c7 ("resource: Fix find_next_iomem_res() iteration issue")
> 0e4c12b45aa8 ("x86/mm, resource: Use PAGE_KERNEL protection for ioremap of memory pages")
> 1d2e733b13b4 ("resource: Provide resource struct in resource walk callback")
> 4ac2aed837cb ("resource: Consolidate resource walking code")
> 60fe3910bb02 ("kexec_file: Allow arch-specific memory walking for kexec_add_buffer")
> a0458284f062 ("powerpc: Add support code for kexec_file_load()")
> a98959fdbda1 ("resource: Include resource end in walk_*() interfaces")
> da6658859b9c ("powerpc: Change places using CONFIG_KEXEC to use CONFIG_KEXEC_CORE instead.")
> ec2b9bfaac44 ("kexec_file: Change kexec_add_buffer to take kexec_buf as argument.")
Is there a reason 010a93bf97c7 ("resource: Fix find_next_iomem_res()
iteration issue”) was not backported?
For 4.19 the following passes compilation.
-- >8 --
From: Nadav Amit <namit(a)vmware.com>
Subject: [PATCH] resource: Fix locking in find_next_iomem_res()
Since resources can be removed, locking should ensure that the resource
is not removed while accessing it. However, find_next_iomem_res() does
not hold the lock while copying the data of the resource. Keep holding
the lock while the data is copied.
Fixes: ff3cc952d3f00 ("resource: Add remove_resource interface")
Cc: stable(a)vger.kernel.org
Cc: Borislav Petkov <bp(a)suse.de>
Cc: Toshi Kani <toshi.kani(a)hpe.com>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Dave Hansen <dave.hansen(a)linux.intel.com>
Cc: Dan Williams <dan.j.williams(a)intel.com>
Cc: Bjorn Helgaas <bhelgaas(a)google.com>
Cc: Ingo Molnar <mingo(a)kernel.org>
Signed-off-by: Nadav Amit <namit(a)vmware.com>
---
kernel/resource.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/kernel/resource.c b/kernel/resource.c
index 30e1bc68503b..0201feade7d5 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -331,6 +331,7 @@ static int find_next_iomem_res(struct resource *res, unsigned long desc,
resource_size_t start, end;
struct resource *p;
bool sibling_only = false;
+ int r = 0;
BUG_ON(!res);
@@ -356,9 +357,11 @@ static int find_next_iomem_res(struct resource *res, unsigned long desc,
break;
}
- read_unlock(&resource_lock);
- if (!p)
- return -1;
+ if (!p) {
+ r = -1;
+ goto out;
+ }
+
/* copy data */
if (res->start < p->start)
res->start = p->start;
@@ -366,7 +369,9 @@ static int find_next_iomem_res(struct resource *res, unsigned long desc,
res->end = p->end;
res->flags = p->flags;
res->desc = p->desc;
- return 0;
+out:
+ read_unlock(&resource_lock);
+ return r;
}
static int __walk_iomem_res_desc(struct resource *res, unsigned long desc,
--
2.17.1