Linux-Security-Module Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] smack: fix slab-out-of-bounds by checking for overflow
@ 2020-07-25 12:58 B K Karthik
  2020-07-27 17:38 ` Casey Schaufler
  0 siblings, 1 reply; 2+ messages in thread
From: B K Karthik @ 2020-07-25 12:58 UTC (permalink / raw)
  To: Casey Schaufler, James Morris, Serge E. Hallyn,
	linux-security-module, linux-kernel, gregkh, skhan,
	syzkaller-bugs


[-- Attachment #1: Type: text/plain, Size: 4857 bytes --]

add a barrier to smk_set_cipso() to check for overflow

==================================================================
BUG: KASAN: slab-out-of-bounds in vsscanf+0x2666/0x2ef0 lib/vsprintf.c:3321
Read of size 1 at addr ffff888097d682b8 by task syz-executor980/6804

CPU: 0 PID: 6804 Comm: syz-executor980 Not tainted 5.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1f0/0x31e lib/dump_stack.c:118
 print_address_description+0x66/0x5a0 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report+0x132/0x1d0 mm/kasan/report.c:530
 vsscanf+0x2666/0x2ef0 lib/vsprintf.c:3321
 sscanf+0x6c/0x90 lib/vsprintf.c:3527
 smk_set_cipso+0x374/0x6c0 security/smack/smackfs.c:908
 vfs_write+0x2dd/0xc70 fs/read_write.c:576
 ksys_write+0x11b/0x220 fs/read_write.c:631
 do_syscall_64+0x73/0xe0 arch/x86/entry/common.c:384
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4402d9
Code: Bad RIP value.
RSP: 002b:00007ffe89010db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004402d9
RDX: 0000000000000037 RSI: 0000000020000040 RDI: 0000000000000003
RBP: 00000000006ca018 R08: 0000000000000014 R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401ae0
R13: 0000000000401b70 R14: 0000000000000000 R15: 0000000000000000

Allocated by task 6804:
 save_stack mm/kasan/common.c:48 [inline]
 set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc+0x103/0x140 mm/kasan/common.c:494
 __do_kmalloc mm/slab.c:3656 [inline]
 __kmalloc_track_caller+0x249/0x320 mm/slab.c:3671
 memdup_user_nul+0x26/0xf0 mm/util.c:259
 smk_set_cipso+0xff/0x6c0 security/smack/smackfs.c:859
 vfs_write+0x2dd/0xc70 fs/read_write.c:576
 ksys_write+0x11b/0x220 fs/read_write.c:631
 do_syscall_64+0x73/0xe0 arch/x86/entry/common.c:384
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 4906:
 save_stack mm/kasan/common.c:48 [inline]
 set_track mm/kasan/common.c:56 [inline]
 kasan_set_free_info mm/kasan/common.c:316 [inline]
 __kasan_slab_free+0x114/0x170 mm/kasan/common.c:455
 __cache_free mm/slab.c:3426 [inline]
 kfree+0x10a/0x220 mm/slab.c:3757
 tomoyo_path_number_perm+0x525/0x690 security/tomoyo/file.c:736
 tomoyo_path_mknod+0x128/0x150 security/tomoyo/tomoyo.c:240
 security_path_mknod+0xdc/0x160 security/security.c:1077
 may_o_create fs/namei.c:2919 [inline]
 lookup_open fs/namei.c:3060 [inline]
 open_last_lookups fs/namei.c:3169 [inline]
 path_openat+0xbe8/0x37f0 fs/namei.c:3357
 do_filp_open+0x191/0x3a0 fs/namei.c:3387
 do_sys_openat2+0x463/0x770 fs/open.c:1179
 do_sys_open fs/open.c:1195 [inline]
 ksys_open include/linux/syscalls.h:1388 [inline]
 __do_sys_open fs/open.c:1201 [inline]
 __se_sys_open fs/open.c:1199 [inline]
 __x64_sys_open+0x1af/0x1e0 fs/open.c:1199
 do_syscall_64+0x73/0xe0 arch/x86/entry/common.c:384
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff888097d68280
 which belongs to the cache kmalloc-64 of size 64
The buggy address is located 56 bytes inside of
 64-byte region [ffff888097d68280, ffff888097d682c0)
The buggy address belongs to the page:
page:ffffea00025f5a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888097d68c80
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea000288fe08 ffffea00026f38c8 ffff8880aa400380
raw: ffff888097d68c80 ffff888097d68000 000000010000001e 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888097d68180: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc
 ffff888097d68200: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888097d68280: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
                                        ^
 ffff888097d68300: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc
 ffff888097d68380: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Reported-and-testedby: syzbot+a22c6092d003d6fe1122@syzkaller.appspotmail.com
Signed-off-by: B K Karthik <bkkarthik@pesu.pes.edu>
---
 security/smack/smackfs.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 58d3f43cc8bb..17809310d046 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -905,6 +905,11 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
 
 	for (i = 0; i < catlen; i++) {
 		rule += SMK_DIGITLEN;
+		if (rule > data + count) {
+			rc = -EOVERFLOW;
+			goto out;
+		}
+
 		ret = sscanf(rule, "%u", &cat);
 		if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM)
 			goto out;
-- 
2.20.1


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] smack: fix slab-out-of-bounds by checking for overflow
  2020-07-25 12:58 [PATCH] smack: fix slab-out-of-bounds by checking for overflow B K Karthik
@ 2020-07-27 17:38 ` Casey Schaufler
  0 siblings, 0 replies; 2+ messages in thread
From: Casey Schaufler @ 2020-07-27 17:38 UTC (permalink / raw)
  To: B K Karthik, James Morris, Serge E. Hallyn,
	linux-security-module, linux-kernel, gregkh, skhan,
	syzkaller-bugs, Casey Schaufler

On 7/25/2020 5:58 AM, B K Karthik wrote:
> add a barrier to smk_set_cipso() to check for overflow

Thank you for your patch. Dan Carpenter <dan.carpenter@oracle.com>
has already submitted an identical patch.

>
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in vsscanf+0x2666/0x2ef0 lib/vsprintf.c:3321
> Read of size 1 at addr ffff888097d682b8 by task syz-executor980/6804
>
> CPU: 0 PID: 6804 Comm: syz-executor980 Not tainted 5.8.0-rc5-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
>  __dump_stack lib/dump_stack.c:77 [inline]
>  dump_stack+0x1f0/0x31e lib/dump_stack.c:118
>  print_address_description+0x66/0x5a0 mm/kasan/report.c:383
>  __kasan_report mm/kasan/report.c:513 [inline]
>  kasan_report+0x132/0x1d0 mm/kasan/report.c:530
>  vsscanf+0x2666/0x2ef0 lib/vsprintf.c:3321
>  sscanf+0x6c/0x90 lib/vsprintf.c:3527
>  smk_set_cipso+0x374/0x6c0 security/smack/smackfs.c:908
>  vfs_write+0x2dd/0xc70 fs/read_write.c:576
>  ksys_write+0x11b/0x220 fs/read_write.c:631
>  do_syscall_64+0x73/0xe0 arch/x86/entry/common.c:384
>  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> RIP: 0033:0x4402d9
> Code: Bad RIP value.
> RSP: 002b:00007ffe89010db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004402d9
> RDX: 0000000000000037 RSI: 0000000020000040 RDI: 0000000000000003
> RBP: 00000000006ca018 R08: 0000000000000014 R09: 00000000004002c8
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401ae0
> R13: 0000000000401b70 R14: 0000000000000000 R15: 0000000000000000
>
> Allocated by task 6804:
>  save_stack mm/kasan/common.c:48 [inline]
>  set_track mm/kasan/common.c:56 [inline]
>  __kasan_kmalloc+0x103/0x140 mm/kasan/common.c:494
>  __do_kmalloc mm/slab.c:3656 [inline]
>  __kmalloc_track_caller+0x249/0x320 mm/slab.c:3671
>  memdup_user_nul+0x26/0xf0 mm/util.c:259
>  smk_set_cipso+0xff/0x6c0 security/smack/smackfs.c:859
>  vfs_write+0x2dd/0xc70 fs/read_write.c:576
>  ksys_write+0x11b/0x220 fs/read_write.c:631
>  do_syscall_64+0x73/0xe0 arch/x86/entry/common.c:384
>  entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> Freed by task 4906:
>  save_stack mm/kasan/common.c:48 [inline]
>  set_track mm/kasan/common.c:56 [inline]
>  kasan_set_free_info mm/kasan/common.c:316 [inline]
>  __kasan_slab_free+0x114/0x170 mm/kasan/common.c:455
>  __cache_free mm/slab.c:3426 [inline]
>  kfree+0x10a/0x220 mm/slab.c:3757
>  tomoyo_path_number_perm+0x525/0x690 security/tomoyo/file.c:736
>  tomoyo_path_mknod+0x128/0x150 security/tomoyo/tomoyo.c:240
>  security_path_mknod+0xdc/0x160 security/security.c:1077
>  may_o_create fs/namei.c:2919 [inline]
>  lookup_open fs/namei.c:3060 [inline]
>  open_last_lookups fs/namei.c:3169 [inline]
>  path_openat+0xbe8/0x37f0 fs/namei.c:3357
>  do_filp_open+0x191/0x3a0 fs/namei.c:3387
>  do_sys_openat2+0x463/0x770 fs/open.c:1179
>  do_sys_open fs/open.c:1195 [inline]
>  ksys_open include/linux/syscalls.h:1388 [inline]
>  __do_sys_open fs/open.c:1201 [inline]
>  __se_sys_open fs/open.c:1199 [inline]
>  __x64_sys_open+0x1af/0x1e0 fs/open.c:1199
>  do_syscall_64+0x73/0xe0 arch/x86/entry/common.c:384
>  entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> The buggy address belongs to the object at ffff888097d68280
>  which belongs to the cache kmalloc-64 of size 64
> The buggy address is located 56 bytes inside of
>  64-byte region [ffff888097d68280, ffff888097d682c0)
> The buggy address belongs to the page:
> page:ffffea00025f5a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888097d68c80
> flags: 0xfffe0000000200(slab)
> raw: 00fffe0000000200 ffffea000288fe08 ffffea00026f38c8 ffff8880aa400380
> raw: ffff888097d68c80 ffff888097d68000 000000010000001e 0000000000000000
> page dumped because: kasan: bad access detected
>
> Memory state around the buggy address:
>  ffff888097d68180: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc
>  ffff888097d68200: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>> ffff888097d68280: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
>                                         ^
>  ffff888097d68300: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc
>  ffff888097d68380: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc
> ==================================================================
>
> Reported-and-testedby: syzbot+a22c6092d003d6fe1122@syzkaller.appspotmail.com
> Signed-off-by: B K Karthik <bkkarthik@pesu.pes.edu>
> ---
>  security/smack/smackfs.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
> index 58d3f43cc8bb..17809310d046 100644
> --- a/security/smack/smackfs.c
> +++ b/security/smack/smackfs.c
> @@ -905,6 +905,11 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
>  
>  	for (i = 0; i < catlen; i++) {
>  		rule += SMK_DIGITLEN;
> +		if (rule > data + count) {
> +			rc = -EOVERFLOW;
> +			goto out;
> +		}
> +
>  		ret = sscanf(rule, "%u", &cat);
>  		if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM)
>  			goto out;

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-25 12:58 [PATCH] smack: fix slab-out-of-bounds by checking for overflow B K Karthik
2020-07-27 17:38 ` Casey Schaufler

Linux-Security-Module Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-security-module/0 linux-security-module/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-security-module linux-security-module/ https://lore.kernel.org/linux-security-module \
		linux-security-module@vger.kernel.org
	public-inbox-index linux-security-module

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-security-module


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git