diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2024-09-02 11:56:59 +0200 |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2024-09-02 11:56:59 +0200 |
| commit | 342123d6913c62be17e5ca1bb325758c5fd0db34 (patch) | |
| tree | 44a9a8aa6910907014bca41bc6272aa27d0e9b50 /security/selinux/hooks.c | |
| parent | 5916be8a53de6401871bdd953f6c60237b47d6d3 (diff) | |
| parent | 3d5c2f8e75a55cfb11a85086c71996af0354a1fb (diff) | |
| download | lwn-342123d6913c62be17e5ca1bb325758c5fd0db34.tar.gz lwn-342123d6913c62be17e5ca1bb325758c5fd0db34.zip | |
Merge tag 'timers-v6.11-rc7' of https://git.linaro.org/people/daniel.lezcano/linux into timers/urgent
Pull clocksource driver fixes from Daniel Lezcano:
- Remove percpu irq related code in the timer-of initialization
routine as it is broken but also unused (Daniel Lezcano)
- Fix return -ETIME when delta exceeds INT_MAX and the next event not
taking effect sometimes (Jacky Bai)
Link: https://lore.kernel.org/all/d0e93dbd-b796-4726-b38c-089b685591c9@linaro.org
Diffstat (limited to 'security/selinux/hooks.c')
| -rw-r--r-- | security/selinux/hooks.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 55c78c318ccd..400eca4ad0fb 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3852,7 +3852,17 @@ static int selinux_file_mprotect(struct vm_area_struct *vma, if (default_noexec && (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) { int rc = 0; - if (vma_is_initial_heap(vma)) { + /* + * We don't use the vma_is_initial_heap() helper as it has + * a history of problems and is currently broken on systems + * where there is no heap, e.g. brk == start_brk. Before + * replacing the conditional below with vma_is_initial_heap(), + * or something similar, please ensure that the logic is the + * same as what we have below or you have tested every possible + * corner case you can think to test. + */ + if (vma->vm_start >= vma->vm_mm->start_brk && + vma->vm_end <= vma->vm_mm->brk) { rc = avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__EXECHEAP, NULL); } else if (!vma->vm_file && (vma_is_initial_stack(vma) || @@ -6650,8 +6660,8 @@ static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen */ static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) { - return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX, - ctx, ctxlen, 0); + return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX, + ctx, ctxlen, 0, NULL); } static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) |