Re: [PATCH 1/4] selinux: do not cancel a policy conversion that never started

[Paul Moore]

On Jul 31, 2026 Bryam Vargas <hexlabsecurity@xxxxxxxxx> wrote:
> 
> sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes()
> fails, and that helper dereferences the outgoing policy to cancel its
> sidtab conversion. On the first policy load there is no outgoing policy:
> security_load_policy() returns early for that case, before it converts
> anything, and state->policy is still NULL. A first load that fails while
> building the selinuxfs tree therefore takes a NULL dereference in
> selinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load.
> 
> Skip the cancel when there is no old policy, mirroring the check
> security_load_policy() already makes before it converts.
> 
> Fixes: 02a52c5c8c3b ("selinux: move policy commit after updating selinuxfs")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
> Acked-by: Stephen Smalley <stephen.smalley.work@xxxxxxxxx>
> ---
>  security/selinux/ss/services.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Merged into selinux/stable-7.2, thanks.

--
paul-moore.com