| Message ID | 20200725125800.vahdiagxilinzoqw@pesu.pes.edu (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | smack: fix slab-out-of-bounds by checking for overflow | expand |
On 7/25/2020 5:58 AM, B K Karthik wrote: > add a barrier to smk_set_cipso() to check for overflow Thank you for your patch. Dan Carpenter <dan.carpenter@oracle.com> has already submitted an identical patch. > > ================================================================== > BUG: KASAN: slab-out-of-bounds in vsscanf+0x2666/0x2ef0 lib/vsprintf.c:3321 > Read of size 1 at addr ffff888097d682b8 by task syz-executor980/6804 > > CPU: 0 PID: 6804 Comm: syz-executor980 Not tainted 5.8.0-rc5-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x1f0/0x31e lib/dump_stack.c:118 > print_address_description+0x66/0x5a0 mm/kasan/report.c:383 > __kasan_report mm/kasan/report.c:513 [inline] > kasan_report+0x132/0x1d0 mm/kasan/report.c:530 > vsscanf+0x2666/0x2ef0 lib/vsprintf.c:3321 > sscanf+0x6c/0x90 lib/vsprintf.c:3527 > smk_set_cipso+0x374/0x6c0 security/smack/smackfs.c:908 > vfs_write+0x2dd/0xc70 fs/read_write.c:576 > ksys_write+0x11b/0x220 fs/read_write.c:631 > do_syscall_64+0x73/0xe0 arch/x86/entry/common.c:384 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > RIP: 0033:0x4402d9 > Code: Bad RIP value. > RSP: 002b:00007ffe89010db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 > RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004402d9 > RDX: 0000000000000037 RSI: 0000000020000040 RDI: 0000000000000003 > RBP: 00000000006ca018 R08: 0000000000000014 R09: 00000000004002c8 > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401ae0 > R13: 0000000000401b70 R14: 0000000000000000 R15: 0000000000000000 > > Allocated by task 6804: > save_stack mm/kasan/common.c:48 [inline] > set_track mm/kasan/common.c:56 [inline] > __kasan_kmalloc+0x103/0x140 mm/kasan/common.c:494 > __do_kmalloc mm/slab.c:3656 [inline] > __kmalloc_track_caller+0x249/0x320 mm/slab.c:3671 > memdup_user_nul+0x26/0xf0 mm/util.c:259 > smk_set_cipso+0xff/0x6c0 security/smack/smackfs.c:859 > vfs_write+0x2dd/0xc70 fs/read_write.c:576 > ksys_write+0x11b/0x220 fs/read_write.c:631 > do_syscall_64+0x73/0xe0 arch/x86/entry/common.c:384 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > Freed by task 4906: > save_stack mm/kasan/common.c:48 [inline] > set_track mm/kasan/common.c:56 [inline] > kasan_set_free_info mm/kasan/common.c:316 [inline] > __kasan_slab_free+0x114/0x170 mm/kasan/common.c:455 > __cache_free mm/slab.c:3426 [inline] > kfree+0x10a/0x220 mm/slab.c:3757 > tomoyo_path_number_perm+0x525/0x690 security/tomoyo/file.c:736 > tomoyo_path_mknod+0x128/0x150 security/tomoyo/tomoyo.c:240 > security_path_mknod+0xdc/0x160 security/security.c:1077 > may_o_create fs/namei.c:2919 [inline] > lookup_open fs/namei.c:3060 [inline] > open_last_lookups fs/namei.c:3169 [inline] > path_openat+0xbe8/0x37f0 fs/namei.c:3357 > do_filp_open+0x191/0x3a0 fs/namei.c:3387 > do_sys_openat2+0x463/0x770 fs/open.c:1179 > do_sys_open fs/open.c:1195 [inline] > ksys_open include/linux/syscalls.h:1388 [inline] > __do_sys_open fs/open.c:1201 [inline] > __se_sys_open fs/open.c:1199 [inline] > __x64_sys_open+0x1af/0x1e0 fs/open.c:1199 > do_syscall_64+0x73/0xe0 arch/x86/entry/common.c:384 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > The buggy address belongs to the object at ffff888097d68280 > which belongs to the cache kmalloc-64 of size 64 > The buggy address is located 56 bytes inside of > 64-byte region [ffff888097d68280, ffff888097d682c0) > The buggy address belongs to the page: > page:ffffea00025f5a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888097d68c80 > flags: 0xfffe0000000200(slab) > raw: 00fffe0000000200 ffffea000288fe08 ffffea00026f38c8 ffff8880aa400380 > raw: ffff888097d68c80 ffff888097d68000 000000010000001e 0000000000000000 > page dumped because: kasan: bad access detected > > Memory state around the buggy address: > ffff888097d68180: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc > ffff888097d68200: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >> ffff888097d68280: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc > ^ > ffff888097d68300: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc > ffff888097d68380: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc > ================================================================== > > Reported-and-testedby: syzbot+a22c6092d003d6fe1122@syzkaller.appspotmail.com > Signed-off-by: B K Karthik <bkkarthik@pesu.pes.edu> > --- > security/smack/smackfs.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c > index 58d3f43cc8bb..17809310d046 100644 > --- a/security/smack/smackfs.c > +++ b/security/smack/smackfs.c > @@ -905,6 +905,11 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, > > for (i = 0; i < catlen; i++) { > rule += SMK_DIGITLEN; > + if (rule > data + count) { > + rc = -EOVERFLOW; > + goto out; > + } > + > ret = sscanf(rule, "%u", &cat); > if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM) > goto out;
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index 58d3f43cc8bb..17809310d046 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c @@ -905,6 +905,11 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, for (i = 0; i < catlen; i++) { rule += SMK_DIGITLEN; + if (rule > data + count) { + rc = -EOVERFLOW; + goto out; + } + ret = sscanf(rule, "%u", &cat); if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM) goto out;