Re: [PATCH v4 04/42] selinux: dynamically allocate selinux namespace

[Simon Horman <horms@kernel.org>]

On Tue, Jun 10, 2025 at 01:21:35PM -0400, Stephen Smalley wrote:
> Move from static allocation of a single selinux namespace to
> dynamic allocation.  Include necessary support for lifecycle management
> of the selinux namespace, modeled after the user namespace support.
> 
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>

...

> diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
> index 112edf9b2106..c67965cbfcba 100644
> --- a/security/selinux/ss/services.c
> +++ b/security/selinux/ss/services.c
> @@ -2202,7 +2202,7 @@ static void security_load_policycaps(struct selinux_state *state,
>  static int security_preserve_bools(struct selinux_policy *oldpolicy,
>  				struct selinux_policy *newpolicy);
>  
> -static void selinux_policy_free(struct selinux_policy *policy)
> +void selinux_policy_free(struct selinux_policy __rcu *policy)

Hi Stephen,

It looks like this __rcu annotation is insufficient, and further updates
are needed. I didn't look further, but Sparse says:

  .../services.c:2212:27: warning: incorrect type in argument 1 (different address spaces)
  .../services.c:2212:27:    expected struct policydb *p
  .../services.c:2212:27:    got struct policydb [noderef] __rcu *
  .../services.c:2214:15: warning: incorrect type in argument 1 (different address spaces)
  .../services.c:2214:15:    expected void const *objp
  .../services.c:2214:15:    got struct selinux_policy [noderef] __rcu *policy
  .../services.c:2232:39: warning: incorrect type in argument 1 (different address spaces)
  .../services.c:2232:39:    expected struct selinux_policy [noderef] __rcu *policy
  .../services.c:2232:39:    got struct selinux_policy *policy
  .../services.c:2297:29: warning: incorrect type in argument 1 (different address spaces)
  .../services.c:2297:29:    expected struct selinux_policy [noderef] __rcu *policy
  .../services.c:2297:29:    got struct selinux_policy *[assigned] oldpolicy
  .../services.c:2210:24: warning: dereference of noderef expression
  .../services.c:2211:15: warning: dereference of noderef expression
  .../services.c:2213:15: warning: dereference of noderef expression



>  {
>  	if (!policy)
>  		return;

...