Re: [PATCH v2] selinux: fix data race on AVC latest_notif

[sashiko-bot@kernel.org]

> From: Christian Göttsche <cgzones@googlemail.com>
> 
> avc_policy_seqno() reads latest_notif without holding notif_lock, while
> avc_latest_notif_update() can update it under that lock. KCSAN reports
> these concurrent accesses during policy boolean updates and permission
> checks.
> 
> Use READ_ONCE() for the lockless read and WRITE_ONCE() for the update.
> The spinlock continues to serialize the comparison and update against
> other writers. Reads made while holding notif_lock cannot race with a
> writer and can remain plain accesses.
> 
> This marks both sides of the intentional concurrent access and constrains
> compiler transformations, without suppressing checking with data_race().
> 
> Fixes: 788e7dd4c22e ("SELinux: Improve read/write performance")
> Reported-by: syzbot+a7f7cb0737bd91aa698c@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=a7f7cb0737bd91aa698c
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923101323.2996793-1-cgoettsche@seltendoof.de?part=1