archive mirror
 help / color / mirror / Atom feed
* selinux_netlink_send changes program behavior
@ 2020-04-24  8:27 Dmitry Vyukov
  2020-04-24 21:51 ` Paul Moore
  0 siblings, 1 reply; 6+ messages in thread
From: Dmitry Vyukov @ 2020-04-24  8:27 UTC (permalink / raw)
  To: Paul Moore,, Eric Paris, selinux
  Cc: LKML, syzkaller, Willem de Bruijn

Hi SELinux maintainers,

We've hit a case where a developer wasn't able to reproduce a kernel
bug, it turned out to be a difference in behavior between SELinux and
non-SELinux kernels.
Condensed version: a program does sendmmsg on netlink socket with 2
mmsghdr's, first is completely empty/zeros, second contains some
actual payload. Without SELinux the first mmsghdr is treated as no-op
and the kernel processes the second one (triggers bug). However the
SELinux hook does:

static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
    if (skb->len < NLMSG_HDRLEN) {
        err = -EINVAL;
        goto out;

and fails processing on the first empty mmsghdr (does not happen
without SELinux).

Is this difference in behavior intentional/acceptable/should be fixed?


FTR, the C program is:
kernel config:
on upstream commit 50cc09c1 it triggers a KASAN bug without SELinux,
but does not with SELinux.

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2020-04-28  1:54 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-24  8:27 selinux_netlink_send changes program behavior Dmitry Vyukov
2020-04-24 21:51 ` Paul Moore
2020-04-25  5:14   ` Dmitry Vyukov
2020-04-25 11:42     ` Paul Moore
2020-04-25 12:00       ` Dmitry Vyukov
2020-04-28  1:53         ` Paul Moore

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).