1 files changed, 27 insertions, 9 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 1dd948485e48..d5d67c93b65c 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1402,15 +1402,33 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
                 isec->sid = sbsec->sid;
 
                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
-                        if (opt_dentry) {
-                                isec->sclass = inode_mode_to_security_class(inode->i_mode);
-                                rc = selinux_proc_get_sid(opt_dentry,
-                                                          isec->sclass,
-                                                          &sid);
-                                if (rc)
-                                        goto out_unlock;
-                                isec->sid = sid;
-                        }
+                        /* We must have a dentry to determine the label on
+                         * procfs inodes */
+                        if (opt_dentry)
+                                /* Called from d_instantiate or
+                                 * d_splice_alias. */
+                                dentry = dget(opt_dentry);
+                        else
+                                /* Called from selinux_complete_init, try to
+                                 * find a dentry. */
+                                dentry = d_find_alias(inode);
+                        /*
+                         * This can be hit on boot when a file is accessed
+                         * before the policy is loaded.  When we load policy we
+                         * may find inodes that have no dentry on the
+                         * sbsec->isec_head list.  No reason to complain as
+                         * these will get fixed up the next time we go through
+                         * inode_doinit() with a dentry, before these inodes
+                         * could be used again by userspace.
+                         */
+                        if (!dentry)
+                                goto out_unlock;
+                        isec->sclass = inode_mode_to_security_class(inode->i_mode);
+                        rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
+                        dput(dentry);
+                        if (rc)
+                                goto out_unlock;
+                        isec->sid = sid;
                 }
                 break;
         }