From: Mimi Zohar <zohar@linux.ibm.com>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: linux-integrity@vger.kernel.org,
Test <test@localhost.localdomain>,
James Morris <jmorris@namei.org>,
"Serge E . Hallyn" <serge@hallyn.com>,
linux-security-module <linux-security-module@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Eric Biggers <ebiggers@kernel.org>,
Mimi Zohar <zohar@linux.ibm.com>
Subject: [RFC PATCH 2/2] integrity: double check iint_cache was initialized
Date: Fri, 19 Mar 2021 16:03:58 -0400 [thread overview]
Message-ID: <20210319200358.22816-2-zohar@linux.ibm.com> (raw)
In-Reply-To: <20210319200358.22816-1-zohar@linux.ibm.com>
From: Test <test@localhost.localdomain>
The integrity's "iint_cache" is initialized at security_init(). Only
after an IMA policy is loaded, which is initialized at late_initcall,
is a file's integrity status stored in the "iint_cache".
All integrity_inode_get() callers first verify that the IMA policy has
been loaded, before calling it. Yet for some reason, it is still being
called, causing a NULL pointer dereference.
As reported by Dmitry Vyukov:
in qemu:
qemu-system-x86_64 -enable-kvm -machine q35,nvdimm -cpu
max,migratable=off -smp 4 -m 4G,slots=4,maxmem=16G -hda
wheezy.img -kernel arch/x86/boot/bzImage -nographic -vga std
-soundhw all -usb -usbdevice tablet -bt hci -bt device:keyboard
-net user,host=10.0.2.10,hostfwd=tcp::10022-:22 -net
nic,model=virtio-net-pci -object
memory-backend-file,id=pmem1,share=off,mem-path=/dev/zero,size=64M
-device nvdimm,id=nvdimm1,memdev=pmem1 -append "console=ttyS0
root=/dev/sda earlyprintk=serial rodata=n oops=panic panic_on_warn=1
panic=86400 lsm=smack numa=fake=2 nopcid dummy_hcd.num=8" -pidfile
vm_pid -m 2G -cpu host
But it crashes on NULL deref in integrity_inode_get during boot:
Run /sbin/init as init process
BUG: kernel NULL pointer dereference, address: 000000000000001c
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc2+ #97
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.13.0-44-g88ab0c15525c-prebuilt.qemu.org 04/01/2014
RIP: 0010:kmem_cache_alloc+0x2b/0x370 mm/slub.c:2920
Code: 57 41 56 41 55 41 54 41 89 f4 55 48 89 fd 53 48 83 ec 10 44 8b
3d d9 1f 90 0b 65 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 <8b> 5f
1c 4cf
RSP: 0000:ffffc9000032f9d8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888017fc4f00 RCX: 0000000000000000
RDX: ffff888040220000 RSI: 0000000000000c40 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffff888019263627
R10: ffffffff83937cd1 R11: 0000000000000000 R12: 0000000000000c40
R13: ffff888019263538 R14: 0000000000000000 R15: 0000000000ffffff
FS: 0000000000000000(0000) GS:ffff88802d180000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000001c CR3: 000000000b48e000 CR4: 0000000000750ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
integrity_inode_get+0x47/0x260 security/integrity/iint.c:105
process_measurement+0x33d/0x17e0 security/integrity/ima/ima_main.c:237
ima_bprm_check+0xde/0x210 security/integrity/ima/ima_main.c:474
security_bprm_check+0x7d/0xa0 security/security.c:845
search_binary_handler fs/exec.c:1708 [inline]
exec_binprm fs/exec.c:1761 [inline]
bprm_execve fs/exec.c:1830 [inline]
bprm_execve+0x764/0x19a0 fs/exec.c:1792
kernel_execve+0x370/0x460 fs/exec.c:1973
try_to_run_init_process+0x14/0x4e init/main.c:1366
kernel_init+0x11d/0x1b8 init/main.c:1477
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Modules linked in:
CR2: 000000000000001c
---[ end trace 22d601a500de7d79 ]---
Before calling kmem_cache_alloc(), check that the iint_cache has
been initialized.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
security/integrity/iint.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/security/integrity/iint.c b/security/integrity/iint.c
index 1d20003243c3..80b5ae7bb712 100644
--- a/security/integrity/iint.c
+++ b/security/integrity/iint.c
@@ -97,6 +97,15 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode)
struct rb_node **p;
struct rb_node *node, *parent = NULL;
struct integrity_iint_cache *iint, *test_iint;
+ static int once = 0;
+
+ if (!iint_cache) { /* shouldn't get here */
+ if (!once) {
+ dump_stack();
+ once = 1;
+ }
+ return NULL;
+ }
iint = integrity_iint_find(inode);
if (iint)
--
2.27.0
next prev parent reply other threads:[~2021-03-19 20:05 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-19 20:03 [RFC PATCH 1/2] ima: don't access a file's integrity status before an IMA policy is loaded Mimi Zohar
2021-03-19 20:03 ` Mimi Zohar [this message]
2021-03-22 7:10 ` [RFC PATCH 2/2] integrity: double check iint_cache was initialized Tetsuo Handa
2021-03-22 7:53 ` Dmitry Vyukov
2021-03-23 1:46 ` Tetsuo Handa
2021-03-23 12:09 ` Mimi Zohar
2021-03-23 13:37 ` Tetsuo Handa
2021-03-23 14:01 ` Tetsuo Handa
2021-03-23 14:47 ` Mimi Zohar
2021-03-23 15:14 ` Tetsuo Handa
2021-03-23 16:13 ` Mimi Zohar
2021-03-24 10:10 ` Tetsuo Handa
2021-03-24 11:10 ` Mimi Zohar
2021-03-24 11:20 ` Tetsuo Handa
2021-03-24 11:37 ` Dmitry Vyukov
2021-03-24 11:49 ` Mimi Zohar
2021-03-24 11:58 ` Dmitry Vyukov
2021-03-24 12:17 ` Mimi Zohar
2021-03-24 15:56 ` Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210319200358.22816-2-zohar@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=dvyukov@google.com \
--cc=ebiggers@kernel.org \
--cc=jmorris@namei.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=test@localhost.localdomain \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).