hc
2024-12-19 9370bb92b2d16684ee45cf24e879c93c509162da
kernel/security/device_cgroup.c
....@@ -81,6 +81,17 @@
8181 return -ENOMEM;
8282 }
8383
84
+static void dev_exceptions_move(struct list_head *dest, struct list_head *orig)
85
+{
86
+ struct dev_exception_item *ex, *tmp;
87
+
88
+ lockdep_assert_held(&devcgroup_mutex);
89
+
90
+ list_for_each_entry_safe(ex, tmp, orig, list) {
91
+ list_move_tail(&ex->list, dest);
92
+ }
93
+}
94
+
8495 /*
8596 * called under devcgroup_mutex
8697 */
....@@ -603,11 +614,13 @@
603614 int count, rc = 0;
604615 struct dev_exception_item ex;
605616 struct dev_cgroup *parent = css_to_devcgroup(devcgroup->css.parent);
617
+ struct dev_cgroup tmp_devcgrp;
606618
607619 if (!capable(CAP_SYS_ADMIN))
608620 return -EPERM;
609621
610622 memset(&ex, 0, sizeof(ex));
623
+ memset(&tmp_devcgrp, 0, sizeof(tmp_devcgrp));
611624 b = buffer;
612625
613626 switch (*b) {
....@@ -619,15 +632,27 @@
619632
620633 if (!may_allow_all(parent))
621634 return -EPERM;
622
- dev_exception_clean(devcgroup);
623
- devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
624
- if (!parent)
635
+ if (!parent) {
636
+ devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
637
+ dev_exception_clean(devcgroup);
625638 break;
639
+ }
626640
627
- rc = dev_exceptions_copy(&devcgroup->exceptions,
628
- &parent->exceptions);
641
+ INIT_LIST_HEAD(&tmp_devcgrp.exceptions);
642
+ rc = dev_exceptions_copy(&tmp_devcgrp.exceptions,
643
+ &devcgroup->exceptions);
629644 if (rc)
630645 return rc;
646
+ dev_exception_clean(devcgroup);
647
+ rc = dev_exceptions_copy(&devcgroup->exceptions,
648
+ &parent->exceptions);
649
+ if (rc) {
650
+ dev_exceptions_move(&devcgroup->exceptions,
651
+ &tmp_devcgrp.exceptions);
652
+ return rc;
653
+ }
654
+ devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
655
+ dev_exception_clean(&tmp_devcgrp);
631656 break;
632657 case DEVCG_DENY:
633658 if (css_has_online_children(&devcgroup->css))