Re: [PATCH 1/4] selinux: do not cancel a policy conversion that never started

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Partial failure in `sel_make_policy_nodes()` fails to roll back the boolean directory swap, leaving selinuxfs in a corrupted torn state.
--

--- Patch [1]: [PATCH 1/4] selinux: do not cancel a policy conversion that never started ---
commit 60502da4772313c1b4e1e77b979bed50ee026bc3
Author: Bryam Vargas <hexlabsecurity@proton.me>

selinux: do not cancel a policy conversion that never started

This commit prevents a NULL pointer dereference in selinux_policy_cancel()
by checking if the old policy exists before attempting to cancel its
sidtab conversion. This handles the case where a first policy load fails
during selinuxfs tree creation.

> sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes()
> fails, and that helper dereferences the outgoing policy to cancel its
> sidtab conversion.

[Severity: High]
This is a pre-existing issue, but looking at sel_make_policy_nodes() in
security/selinux/selinuxfs.c, if a partial failure occurs, could it leave
selinuxfs in a corrupted torn state?

If the class directory rename fails:

security/selinux/selinuxfs.c:sel_make_policy_nodes() {
    ...
	/* classes */
	ret = start_renaming_two_dentries(&rd, tmp_class_dir, fsi->class_dir);
	if (ret)
		goto out;
    ...
}

The function jumps to the error path after already committing the boolean
directory swap.

Is there a missing rollback for the VFS boolean directory swap and the
selinux_fs_info boolean array swaps on this error path?

Without a rollback, could reading or committing booleans via selinuxfs
operate on freed memory or scrambled indices since the old policy data is
freed in the cleanup path?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260731-b4-disp-d32e997b-v1-0-0341d038ee47@proton.me?part=1