1 files changed, 32 insertions, 9 deletions

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 4bca49414a40..2aa9d172dc7e 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2277,7 +2277,7 @@ out:
 }
 
 /**
- * security_genfs_sid - Obtain a SID for a file in a filesystem
+ * __security_genfs_sid - Helper to obtain a SID for a file in a filesystem
  * @fstype: filesystem type
  * @path: path from root of mount
  * @sclass: file security class
@@ -2286,11 +2286,13 @@ out:
  * Obtain a SID to use for a file in a filesystem that
  * cannot support xattr or use a fixed labeling behavior like
  * transition SIDs or task SIDs.
+ *
+ * The caller must acquire the policy_rwlock before calling this function.
  */
-int security_genfs_sid(const char *fstype,
-                       char *path,
-                       u16 orig_sclass,
-                       u32 *sid)
+static inline int __security_genfs_sid(const char *fstype,
+                                       char *path,
+                                       u16 orig_sclass,
+                                       u32 *sid)
 {
         int len;
         u16 sclass;
@@ -2301,8 +2303,6 @@ int security_genfs_sid(const char *fstype,
         while (path[0] == '/' && path[1] == '/')
                 path++;
 
-        read_lock(&policy_rwlock);
-
         sclass = unmap_class(orig_sclass);
         *sid = SECINITSID_UNLABELED;
 
@@ -2336,11 +2336,33 @@ int security_genfs_sid(const char *fstype,
         *sid = c->sid[0];
         rc = 0;
 out:
-        read_unlock(&policy_rwlock);
         return rc;
 }
 
 /**
+ * security_genfs_sid - Obtain a SID for a file in a filesystem
+ * @fstype: filesystem type
+ * @path: path from root of mount
+ * @sclass: file security class
+ * @sid: SID for path
+ *
+ * Acquire policy_rwlock before calling __security_genfs_sid() and release
+ * it afterward.
+ */
+int security_genfs_sid(const char *fstype,
+                       char *path,
+                       u16 orig_sclass,
+                       u32 *sid)
+{
+        int retval;
+
+        read_lock(&policy_rwlock);
+        retval = __security_genfs_sid(fstype, path, orig_sclass, sid);
+        read_unlock(&policy_rwlock);
+        return retval;
+}
+
+/**
  * security_fs_use - Determine how to handle labeling for a filesystem.
  * @sb: superblock in question
  */
@@ -2370,7 +2392,8 @@ int security_fs_use(struct super_block *sb)
                 }
                 sbsec->sid = c->sid[0];
         } else {
-                rc = security_genfs_sid(fstype, "/", SECCLASS_DIR, &sbsec->sid);
+                rc = __security_genfs_sid(fstype, "/", SECCLASS_DIR,
+                                          &sbsec->sid);
                 if (rc) {
                         sbsec->behavior = SECURITY_FS_USE_NONE;
                         rc = 0;