Re: [PATCH 1/4] selinux: do not cancel a policy conversion that never started

Thank you for your contribution! Sashiko AI review found 1 potential issue(=
s) to consider:

Pre-existing issues:
- [High] Partial failure in `sel_make_policy_nodes()` fails to roll back th=
e boolean directory swap, leaving selinuxfs in a corrupted torn state.
--

--- Patch [1]: [PATCH 1/4] selinux: do not cancel a policy conversion that =
never started ---
commit 60502da4772313c1b4e1e77b979bed50ee026bc3
Author: Bryam Vargas <[email protected]>

selinux: do not cancel a policy conversion that never started

This commit prevents a NULL pointer dereference in selinux_policy_cancel()
by checking if the old policy exists before attempting to cancel its
sidtab conversion. This handles the case where a first policy load fails
during selinuxfs tree creation.

> sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes=
()
> fails, and that helper dereferences the outgoing policy to cancel its
> sidtab conversion.

[Severity: High]
This is a pre-existing issue, but looking at sel_make_policy_nodes() in
security/selinux/selinuxfs.c, if a partial failure occurs, could it leave
selinuxfs in a corrupted torn state?

If the class directory rename fails:

security/selinux/selinuxfs.c:sel_make_policy_nodes() {
    ...
	/* classes */
	ret =3D start_renaming_two_dentries(&rd, tmp_class_dir, fsi->class_dir);
	if (ret)
		goto out;
    ...
}

The function jumps to the error path after already committing the boolean
directory swap.

Is there a missing rollback for the VFS boolean directory swap and the
selinux_fs_info boolean array swaps on this error path?

Without a rollback, could reading or committing booleans via selinuxfs
operate on freed memory or scrambled indices since the old policy data is
freed in the cleanup path?

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260731-b4-disp-d3=
[email protected]?part=3D1