From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-3496022-1516348102-2-1035988458260113848 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, HEADER_FROM_DIFFERENT_DOMAINS 0.25, ME_NOAUTH 0.01, RCVD_IN_DNSWL_HI -5, T_RP_MATCHES_RCVD -0.01, LANGUAGES en, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='209.132.180.67', Host='vger.kernel.org', Country='US', FromHeader='org', MailFrom='org' X-Spam-charsets: plain='us-ascii' X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: stable-owner@vger.kernel.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=arctest; t=1516348101; b=IBkmroH3kie4gIu8zFq+ovD78LgJiVuk0s2j5OGS+VY1MaH 7odRVplsVy69eTtAHZt3+XgbhUmrXM243JsWKm7tL4V0NPasMaLUh0mEfVYeG1+l gUEXOjhId8pDH3aeG3pdtjt9ArSwHkIY/4rhnRQhXVZ5KnCc4CbLuuokWB/rdOgI D+Lj6zmZzlgoHnFa4d17JZng+gmH7ks+ZIAiCbpEH5d+RwFCvciZ2LrzQMqp13+b OYxwTAMaV1qBioY8w1ypBcoOfGCyKJTWSRtUVq367+BldoOWkVoXJv9411BjGbvB y7cuUSu7LxL6laUb8ons/GXCi0G55wnUNPVxMbg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=date:from:to:cc:subject:message-id :references:mime-version:content-type:in-reply-to:sender :list-id; s=arctest; t=1516348101; bh=HFg2CVcbnidd6q2bFrMM0MlhxM r9sP2aTSn46cZo9oQ=; b=PmUxetL+GYQDJNkCIOTTUSMUku6qLzAGB30lPi2P+7 kNHk2b41/lFXuCTQhbqq6bxEkM9U7uCKOMFtNAgDw5ETMip2YatoGPe7XV1iPdS8 vT+mI5Ofoy1c/8T5cRxvp1eoIgIgwKAHSdgcP2s6q6KIUreA6Fi8rLTUR2nrfQKT GsEMcjpU2q+zx0gzMx6TOEkpFDXzPiz026nU+y5b3AhdDn1oKZmSO94xhhCAMpyO +ZHVUzviQRKApmytsp75MB9mdYx8kE81vf/Qs5qsHKYxZI7DeaTqxh7xn5aAnCsq gpW4EdctzHDzltymyexnHEPbqc2LAzmnMfpDEYmHQzOg== ARC-Authentication-Results: i=1; mx5.messagingengine.com; arc=none (no signatures found); dkim=none (no signatures found); dmarc=none (p=none,has-list-id=yes,d=none) header.from=linuxfoundation.org; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=linuxfoundation.org header.result=pass header_is_org_domain=yes Authentication-Results: mx5.messagingengine.com; arc=none (no signatures found); dkim=none (no signatures found); dmarc=none (p=none,has-list-id=yes,d=none) header.from=linuxfoundation.org; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=linuxfoundation.org header.result=pass header_is_org_domain=yes Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751200AbeASHsQ (ORCPT ); Fri, 19 Jan 2018 02:48:16 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:57458 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750785AbeASHsP (ORCPT ); Fri, 19 Jan 2018 02:48:15 -0500 Date: Fri, 19 Jan 2018 08:48:12 +0100 From: Greg KH To: Mark Salyzyn Cc: linux-kernel@vger.kernel.org, Paul Moore , Stephen Smalley , Eric Paris , James Morris , "Serge E. Hallyn" , selinux@tycho.nsa.gov, linux-security-module@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] general protection fault in sock_has_perm Message-ID: <20180119074812.GA25687@kroah.com> References: <20180118215853.228182-1-salyzyn@android.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20180118215853.228182-1-salyzyn@android.com> User-Agent: Mutt/1.9.2 (2017-12-15) Sender: stable-owner@vger.kernel.org X-Mailing-List: stable@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On Thu, Jan 18, 2018 at 01:58:45PM -0800, Mark Salyzyn wrote: > general protection fault: 0000 [#1] PREEMPT SMP KASAN > CPU: 1 PID: 14233 Comm: syz-executor2 Not tainted 4.4.112-g5f6325b #28 > task: ffff8801d1095f00 task.stack: ffff8800b5950000 > RIP: 0010:[] [] sock_has_perm+0x1fe/0x3e0 security/selinux/hooks.c:4069 > RSP: 0018:ffff8800b5957ce0 EFLAGS: 00010202 > RAX: dffffc0000000000 RBX: 1ffff10016b2af9f RCX: ffffffff81b69b51 > RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000010 > RBP: ffff8800b5957de0 R08: 0000000000000001 R09: 0000000000000001 > R10: 0000000000000000 R11: 1ffff10016b2af68 R12: ffff8800b5957db8 > R13: 0000000000000000 R14: ffff8800b7259f40 R15: 00000000000000d7 > FS: 00007f72f5ae2700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000a2fa38 CR3: 00000001d7980000 CR4: 0000000000160670 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Stack: > ffffffff81b69a1f ffff8800b5957d58 00008000b5957d30 0000000041b58ab3 > ffffffff83fc82f2 ffffffff81b69980 0000000000000246 ffff8801d1096770 > ffff8801d3165668 ffffffff8157844b ffff8801d1095f00 > ffff880000000001 > Call Trace: > [] selinux_socket_setsockopt+0x4d/0x80 security/selinux/hooks.c:4338 > [] security_socket_setsockopt+0x7d/0xb0 security/security.c:1257 > [] SYSC_setsockopt net/socket.c:1757 [inline] > [] SyS_setsockopt+0xe8/0x250 net/socket.c:1746 > [] entry_SYSCALL_64_fastpath+0x16/0x92 > Code: c2 42 9b b6 81 be 01 00 00 00 48 c7 c7 a0 cb 2b 84 e8 > f7 2f 6d ff 49 8d 7d 10 48 b8 00 00 00 00 00 fc ff df 48 89 > fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 01 00 > 00 41 8b 75 10 31 > RIP [] sock_has_perm+0x1fe/0x3e0 security/selinux/hooks.c:4069 > RSP > ---[ end trace 7b5aaf788fef6174 ]--- > > In the absence of commit a4298e4522d6 ("net: add SOCK_RCU_FREE socket > flag") and all the associated infrastructure changes to take advantage > of a RCU grace period before freeing, there is a heightened > possibility that a security check is performed while an ill-timed > setsockopt call races in from user space. It then is prudent to null > check sk_security, and if the case, reject the permissions. > > This adjustment is orthogonal to infrastructure improvements that may > nullify the needed check, but should be added as good code hygiene. > > Signed-off-by: Mark Salyzyn > Cc: Paul Moore > Cc: Stephen Smalley > Cc: Eric Paris > Cc: James Morris > Cc: "Serge E. Hallyn" > Cc: selinux@tycho.nsa.gov > Cc: linux-security-module@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > Cc: stable@vger.kernel.org > --- > This patch should be applied to all stable trees (author wants > minimum of 3.18, 4.4, 4.9 and 4.14) Note, if you want this type of thing to show up in the patch itself, so I will see it when it hits Linus's tree, you can just change the stable line to be: cc: stable # 3.18+ thanks, greg k-h From mboxrd@z Thu Jan 1 00:00:00 1970 From: gregkh@linuxfoundation.org (Greg KH) Date: Fri, 19 Jan 2018 08:48:12 +0100 Subject: [PATCH] general protection fault in sock_has_perm In-Reply-To: <20180118215853.228182-1-salyzyn@android.com> References: <20180118215853.228182-1-salyzyn@android.com> Message-ID: <20180119074812.GA25687@kroah.com> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org On Thu, Jan 18, 2018 at 01:58:45PM -0800, Mark Salyzyn wrote: > general protection fault: 0000 [#1] PREEMPT SMP KASAN > CPU: 1 PID: 14233 Comm: syz-executor2 Not tainted 4.4.112-g5f6325b #28 > task: ffff8801d1095f00 task.stack: ffff8800b5950000 > RIP: 0010:[] [] sock_has_perm+0x1fe/0x3e0 security/selinux/hooks.c:4069 > RSP: 0018:ffff8800b5957ce0 EFLAGS: 00010202 > RAX: dffffc0000000000 RBX: 1ffff10016b2af9f RCX: ffffffff81b69b51 > RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000010 > RBP: ffff8800b5957de0 R08: 0000000000000001 R09: 0000000000000001 > R10: 0000000000000000 R11: 1ffff10016b2af68 R12: ffff8800b5957db8 > R13: 0000000000000000 R14: ffff8800b7259f40 R15: 00000000000000d7 > FS: 00007f72f5ae2700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000a2fa38 CR3: 00000001d7980000 CR4: 0000000000160670 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Stack: > ffffffff81b69a1f ffff8800b5957d58 00008000b5957d30 0000000041b58ab3 > ffffffff83fc82f2 ffffffff81b69980 0000000000000246 ffff8801d1096770 > ffff8801d3165668 ffffffff8157844b ffff8801d1095f00 > ffff880000000001 > Call Trace: > [] selinux_socket_setsockopt+0x4d/0x80 security/selinux/hooks.c:4338 > [] security_socket_setsockopt+0x7d/0xb0 security/security.c:1257 > [] SYSC_setsockopt net/socket.c:1757 [inline] > [] SyS_setsockopt+0xe8/0x250 net/socket.c:1746 > [] entry_SYSCALL_64_fastpath+0x16/0x92 > Code: c2 42 9b b6 81 be 01 00 00 00 48 c7 c7 a0 cb 2b 84 e8 > f7 2f 6d ff 49 8d 7d 10 48 b8 00 00 00 00 00 fc ff df 48 89 > fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 01 00 > 00 41 8b 75 10 31 > RIP [] sock_has_perm+0x1fe/0x3e0 security/selinux/hooks.c:4069 > RSP > ---[ end trace 7b5aaf788fef6174 ]--- > > In the absence of commit a4298e4522d6 ("net: add SOCK_RCU_FREE socket > flag") and all the associated infrastructure changes to take advantage > of a RCU grace period before freeing, there is a heightened > possibility that a security check is performed while an ill-timed > setsockopt call races in from user space. It then is prudent to null > check sk_security, and if the case, reject the permissions. > > This adjustment is orthogonal to infrastructure improvements that may > nullify the needed check, but should be added as good code hygiene. > > Signed-off-by: Mark Salyzyn > Cc: Paul Moore > Cc: Stephen Smalley > Cc: Eric Paris > Cc: James Morris > Cc: "Serge E. Hallyn" > Cc: selinux at tycho.nsa.gov > Cc: linux-security-module at vger.kernel.org > Cc: linux-kernel at vger.kernel.org > Cc: stable at vger.kernel.org > --- > This patch should be applied to all stable trees (author wants > minimum of 3.18, 4.4, 4.9 and 4.14) Note, if you want this type of thing to show up in the patch itself, so I will see it when it hits Linus's tree, you can just change the stable line to be: cc: stable # 3.18+ thanks, greg k-h -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html