From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-2560276-1516312766-2-4388125605653872030 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, HEADER_FROM_DIFFERENT_DOMAINS 0.25, RCVD_IN_DNSWL_HI -5, T_RP_MATCHES_RCVD -0.01, LANGUAGES unknown, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='209.132.180.67', Host='vger.kernel.org', Country='US', FromHeader='com', MailFrom='org' X-Spam-charsets: X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: stable-owner@vger.kernel.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=arctest; t=1516312765; b=GX05O/5+8mur6GsbsLl3DsumQYkgp97oZ6kIMvHhtR0V6fr 3+JTybaqG1onju5pQW3mnO/HoQX3ZE7TmBiwjd+6EH8Bhrq8RqtpZL3FhjddPuDF PpJH0zvN8xNgKMB1McWZYlSzol4TcQ1nZPozaFEckLMrggDnRH1/GtdtOvOpSKQQ nGkeuaarei3FEHuU5ksdrdHgkSmeQmKXX5waVC8en8NgmK9MfTaBCh52zldyuo3B PICi0xundQT53cMJPBeIiwqRPJUcX7kUjRF0xbP6NVVvv/ypIKuxzcTlWJS9tmFP mK0A909x2EgvYi8xuRfys5JvvqWY5NSFwKS9yoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=from:to:cc:subject:date:message-id:sender :list-id; s=arctest; t=1516312765; bh=/dEsmvyYh6MogLpSpDofKHdye2 WkJselHQLzy+qnZVw=; b=h2fr69Kcr7txFXgR1cZirKxRDXOqCPVhlPycXT0WoZ 5kEWJqiy1spPbbpxTg3okmTUAmelkZ8Dr8Cy3QuWAXX7Xa1/o4YSoLPa/4jk7XFb khgMjR78fhyanSWsrAxGvWiAD7z/NqhFlRYbHSaikYarTuo8Z3PvI3ZRXJmjvWjm A4EvVHyNuXURUZkOkL2rwG7XV4rOv4wDQnOlYIvWtvbkEfaLl/DixofiKYmuBQQF rH/d4qDf46hD+rmU6SZb/YFgD5Kgw1Nym71XLUFoppufmIvwFo1ZNfAxbmWVjx8a S3nanBnLnqEHaF53prHuxcsMZ0zSSIMp2RdQmIC7IzQA== ARC-Authentication-Results: i=1; mx2.messagingengine.com; arc=none (no signatures found); dkim=pass (2048-bit rsa key sha256) header.d=android.com header.i=@android.com header.b=mtTEcOi3 x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20161025; dmarc=pass (p=none,has-list-id=yes,d=none) header.from=android.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=h2wBtvWG; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=android.com header.result=pass header_is_org_domain=yes Authentication-Results: mx2.messagingengine.com; arc=none (no signatures found); dkim=pass (2048-bit rsa key sha256) header.d=android.com header.i=@android.com header.b=mtTEcOi3 x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20161025; dmarc=pass (p=none,has-list-id=yes,d=none) header.from=android.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=h2wBtvWG; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=android.com header.result=pass header_is_org_domain=yes Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753881AbeARV7W (ORCPT ); Thu, 18 Jan 2018 16:59:22 -0500 Received: from mail-pg0-f68.google.com ([74.125.83.68]:43732 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753822AbeARV7U (ORCPT ); Thu, 18 Jan 2018 16:59:20 -0500 X-Google-Smtp-Source: ACJfBoujdXzJtchmgeYVa0UBjV0ICj048BKBOIQ08nHyzX+WbI7zvbiMjpd4DxjcJzE4Au1FSoqgTg== From: Mark Salyzyn To: linux-kernel@vger.kernel.org Cc: Mark Salyzyn , Paul Moore , Stephen Smalley , Eric Paris , James Morris , "Serge E. Hallyn" , selinux@tycho.nsa.gov, linux-security-module@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] general protection fault in sock_has_perm Date: Thu, 18 Jan 2018 13:58:45 -0800 Message-Id: <20180118215853.228182-1-salyzyn@android.com> X-Mailer: git-send-email 2.16.0.rc1.238.g530d649a79-goog Sender: stable-owner@vger.kernel.org X-Mailing-List: stable@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 14233 Comm: syz-executor2 Not tainted 4.4.112-g5f6325b #28 task: ffff8801d1095f00 task.stack: ffff8800b5950000 RIP: 0010:[] [] sock_has_perm+0x1fe/0x3e0 security/selinux/hooks.c:4069 RSP: 0018:ffff8800b5957ce0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 1ffff10016b2af9f RCX: ffffffff81b69b51 RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000010 RBP: ffff8800b5957de0 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000000 R11: 1ffff10016b2af68 R12: ffff8800b5957db8 R13: 0000000000000000 R14: ffff8800b7259f40 R15: 00000000000000d7 FS: 00007f72f5ae2700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000a2fa38 CR3: 00000001d7980000 CR4: 0000000000160670 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff81b69a1f ffff8800b5957d58 00008000b5957d30 0000000041b58ab3 ffffffff83fc82f2 ffffffff81b69980 0000000000000246 ffff8801d1096770 ffff8801d3165668 ffffffff8157844b ffff8801d1095f00 ffff880000000001 Call Trace: [] selinux_socket_setsockopt+0x4d/0x80 security/selinux/hooks.c:4338 [] security_socket_setsockopt+0x7d/0xb0 security/security.c:1257 [] SYSC_setsockopt net/socket.c:1757 [inline] [] SyS_setsockopt+0xe8/0x250 net/socket.c:1746 [] entry_SYSCALL_64_fastpath+0x16/0x92 Code: c2 42 9b b6 81 be 01 00 00 00 48 c7 c7 a0 cb 2b 84 e8 f7 2f 6d ff 49 8d 7d 10 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 01 00 00 41 8b 75 10 31 RIP [] sock_has_perm+0x1fe/0x3e0 security/selinux/hooks.c:4069 RSP ---[ end trace 7b5aaf788fef6174 ]--- In the absence of commit a4298e4522d6 ("net: add SOCK_RCU_FREE socket flag") and all the associated infrastructure changes to take advantage of a RCU grace period before freeing, there is a heightened possibility that a security check is performed while an ill-timed setsockopt call races in from user space. It then is prudent to null check sk_security, and if the case, reject the permissions. This adjustment is orthogonal to infrastructure improvements that may nullify the needed check, but should be added as good code hygiene. Signed-off-by: Mark Salyzyn Cc: Paul Moore Cc: Stephen Smalley Cc: Eric Paris Cc: James Morris Cc: "Serge E. Hallyn" Cc: selinux@tycho.nsa.gov Cc: linux-security-module@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org --- This patch should be applied to all stable trees (author wants minimum of 3.18, 4.4, 4.9 and 4.14) security/selinux/hooks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 8644d864e3c1..95d7c8143373 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4342,7 +4342,7 @@ static int sock_has_perm(struct sock *sk, u32 perms) struct common_audit_data ad; struct lsm_network_audit net = {0,}; - if (sksec->sid == SECINITSID_KERNEL) + if (!sksec || sksec->sid == SECINITSID_KERNEL) return 0; ad.type = LSM_AUDIT_DATA_NET; -- 2.16.0.rc1.238.g530d649a79-goog