On Fri, Jun 13, 2025 at 10:14 AM Simon Horman [off-list ref] wrote:

On Tue, Jun 10, 2025 at 01:21:35PM -0400, Stephen Smalley wrote:

quoted

Move from static allocation of a single selinux namespace to
dynamic allocation.  Include necessary support for lifecycle management
of the selinux namespace, modeled after the user namespace support.

Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>

...

quoted

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 112edf9b2106..c67965cbfcba 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c

@@ -2202,7 +2202,7 @@ static void security_load_policycaps(struct selinux_state *state,
 static int security_preserve_bools(struct selinux_policy *oldpolicy,
                              struct selinux_policy *newpolicy);

-static void selinux_policy_free(struct selinux_policy *policy)
+void selinux_policy_free(struct selinux_policy __rcu *policy)

Hi Stephen,

It looks like this __rcu annotation is insufficient, and further updates
are needed. I didn't look further, but Sparse says:

  .../services.c:2212:27: warning: incorrect type in argument 1 (different address spaces)
  .../services.c:2212:27:    expected struct policydb *p
  .../services.c:2212:27:    got struct policydb [noderef] __rcu *
  .../services.c:2214:15: warning: incorrect type in argument 1 (different address spaces)
  .../services.c:2214:15:    expected void const *objp
  .../services.c:2214:15:    got struct selinux_policy [noderef] __rcu *policy
  .../services.c:2232:39: warning: incorrect type in argument 1 (different address spaces)
  .../services.c:2232:39:    expected struct selinux_policy [noderef] __rcu *policy
  .../services.c:2232:39:    got struct selinux_policy *policy
  .../services.c:2297:29: warning: incorrect type in argument 1 (different address spaces)
  .../services.c:2297:29:    expected struct selinux_policy [noderef] __rcu *policy
  .../services.c:2297:29:    got struct selinux_policy *[assigned] oldpolicy
  .../services.c:2210:24: warning: dereference of noderef expression
  .../services.c:2211:15: warning: dereference of noderef expression
  .../services.c:2213:15: warning: dereference of noderef expression

Thank you, fixed via
https://github.com/stephensmalley/selinux-kernel/commit/66c448df995fb8d6c5c9a4875efc0ab56a5dd21d
and will likely squash into this patch for next submission.

quoted

 {
      if (!policy)
              return;

...