From: "Ahmed S. Darwish" <darwish.07@gmail.com> To: Casey Schaufler <casey@schaufler-ca.com>, Al Viro <viro@ftp.linux.org.uk> Cc: torvalds@osdl.org, akpm@osdl.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] Smackv8: Safe lockless {cipso,load} read operation Date: Sun, 21 Oct 2007 04:25:43 +0200 Message-ID: <20071021022543.GB3091@Ahmed> (raw) In-Reply-To: <20071021014021.GA3091@Ahmed> Hi, Utilizing Al's concers about using smack_cipso_count without locking, here's a patch that remove smack_cipso_count and uses simple list traversing in read() without any counting mechanism. CC: Al Viro <viro@ftp.linux.org.uk> Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com> --- Please apply over omit-non-cipso-lables-in-cipso-seq-start.patch Using smack_{list,cipso}_count in the read context was useless anyway cause we were just traversing the list. diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index b061cd0..c38d0d0 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c @@ -63,16 +63,17 @@ int smack_cipso_direct = SMACK_CIPSO_DIRECT_DEFAULT; static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT; static int smack_list_count; -static int smack_cipso_count; struct smk_list_entry *smack_list; +#define SEQ_READ_FINISHED 1 + /* * Seq_file read operations for /smack/load */ static void *load_seq_start(struct seq_file *s, loff_t *pos) { - if (*pos >= smack_list_count) + if (*pos == SEQ_READ_FINISHED) return NULL; return smack_list; @@ -80,8 +81,13 @@ static void *load_seq_start(struct seq_file *s, loff_t *pos) static void *load_seq_next(struct seq_file *s, void *v, loff_t *pos) { - (*pos)++; - return ((struct smk_list_entry *) v)->smk_next; + struct smk_list_entry *skp = ((struct smk_list_entry *) v)->smk_next; + + if (skp) + return skp; + + *pos = SEQ_READ_FINISHED; + return NULL; } static int load_seq_show(struct seq_file *s, void *v) @@ -306,7 +312,7 @@ static void *cipso_seq_start(struct seq_file *s, loff_t *pos) { struct smack_known *skp = smack_known; - if (*pos >= smack_cipso_count) + if (*pos == SEQ_READ_FINISHED) return NULL; while (skp && !skp->smk_cipso) @@ -319,12 +325,14 @@ static void *cipso_seq_next(struct seq_file *s, void *v, loff_t *pos) { struct smack_known *skp = ((struct smack_known *) v)->smk_next; - (*pos)++; - while (skp && !skp->smk_cipso) skp = skp->smk_next; - return skp; + if (skp) + return skp; + + *pos = SEQ_READ_FINISHED; + return NULL; } /* @@ -488,7 +496,6 @@ static ssize_t smk_write_cipso(struct file *file, const char __user *buf, rc = -ENOMEM; break; } - ++smack_cipso_count; } else scp = NULL; -- Ahmed S. Darwish HomePage: http://darwish.07.googlepages.com Blog: http://darwish-07.blogspot.com
prev parent reply index Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top 2007-10-17 4:17 [PATCH] Version 8 (2.6.23) Smack: Simplified Mandatory Access Control Kernel Casey Schaufler 2007-10-18 4:57 ` Al Viro 2007-10-18 5:10 ` Al Viro 2007-10-19 12:39 ` Ahmed S. Darwish 2007-10-18 20:13 ` Casey Schaufler 2007-10-18 20:26 ` Al Viro 2007-10-21 1:40 ` [PATCH] Smackv8: Omit non-cipso labels in cipso_seq_start Ahmed S. Darwish 2007-10-21 2:25 ` Ahmed S. Darwish [this message]
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20071021022543.GB3091@Ahmed \ --to=darwish.07@gmail.com \ --cc=akpm@osdl.org \ --cc=casey@schaufler-ca.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=torvalds@osdl.org \ --cc=viro@ftp.linux.org.uk \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
LKML Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lkml.kernel.org/lkml/0 lkml/git/0.git git clone --mirror https://lkml.kernel.org/lkml/1 lkml/git/1.git git clone --mirror https://lkml.kernel.org/lkml/2 lkml/git/2.git git clone --mirror https://lkml.kernel.org/lkml/3 lkml/git/3.git git clone --mirror https://lkml.kernel.org/lkml/4 lkml/git/4.git git clone --mirror https://lkml.kernel.org/lkml/5 lkml/git/5.git git clone --mirror https://lkml.kernel.org/lkml/6 lkml/git/6.git git clone --mirror https://lkml.kernel.org/lkml/7 lkml/git/7.git git clone --mirror https://lkml.kernel.org/lkml/8 lkml/git/8.git git clone --mirror https://lkml.kernel.org/lkml/9 lkml/git/9.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 lkml lkml/ https://lkml.kernel.org/lkml \ linux-kernel@vger.kernel.org public-inbox-index lkml Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel AGPL code for this site: git clone https://public-inbox.org/public-inbox.git