Received: by 10.223.185.116 with SMTP id b49csp1145252wrg; Fri, 23 Feb 2018 12:45:08 -0800 (PST) X-Google-Smtp-Source: AH8x226jJ9mH9vITISyW98dWRa0FnmeNYu0Tq88p4aj9lG6jTaITu5XUNcPsY5HsXzb1VUJ4SjuO X-Received: by 10.98.62.14 with SMTP id l14mr1478255pfa.206.1519418707923; Fri, 23 Feb 2018 12:45:07 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519418707; cv=none; d=google.com; s=arc-20160816; b=v8FYLMejW5gINEJnsHgT/T+SgvuKzlRucN+nRGaKcnSFgfkHWw1uMaB2oe4CXQue++ x37hPx4oKe2ZzsXfvSKhSmkUDb2kAvam6DLFDCZdPmxWrt7LktDYbRKGNRNeodQbXr1y m2bM+7qiVvI4MLj1INjWDFXqWVoKfzRwjDlu/QzmIgzNgtJ/CtDuBYZ5GmZ6MvgLdjqx YyrxEB1zmuESiqM5EzO5s1iNPLfDfNd6rmdxy538bfFiKTAI9THSZFWrju9wolN3BZPZ t7oL1UfvUAOI8+rrfdvnSOuu39WkGo/dl6ui9gfJpQV6d3eKe4c29pvOhLbJyIdCGMA9 Mukw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=3wngXkXg/XjLaNviu+PdzFYbCKwXEHjfZFLV4pNdxF4=; b=nvhmcFp/Tf84X29W6Ok3vuiE3PdSM5fFL9CooC4vb16IIMxKmXPy6R4GG2mGnH0ey2 dikSRKzB+8RzMTmpV0WnElySDLlvL65CP2qL5SYNOYvkIC9pyAtd8RbxnhB+8DoxF/E/ hNljWYTVJcZP8SI3sQGl3qjeCX7328V5j+4v+Fskz808TAH6BBK6MBzRhkIEGBdw5nXF j96bVYYUjXNG5eo5e/rie7Viw28JKsBRjzVFrz1g6dQKBbAr/Ooywka8O/8zAG16u8x7 zJIe2b/sj3MlaZaO/VbCXl883s+o81ab7kxVApP1y4dMCjq0TVsWMHEFZkDM74bn3E+y Adcg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l13si1922443pgn.346.2018.02.23.12.44.53; Fri, 23 Feb 2018 12:45:07 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752532AbeBWSdB (ORCPT + 99 others); Fri, 23 Feb 2018 13:33:01 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:36340 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753027AbeBWScx (ORCPT ); Fri, 23 Feb 2018 13:32:53 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 7D7531070; Fri, 23 Feb 2018 18:32:52 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Paul Moore , William Roberts Subject: [PATCH 4.4 010/193] selinux: ensure the context is NUL terminated in security_context_to_sid_core() Date: Fri, 23 Feb 2018 19:24:03 +0100 Message-Id: <20180223170327.748878896@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170325.997716448@linuxfoundation.org> References: <20180223170325.997716448@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Paul Moore commit ef28df55ac27e1e5cd122e19fa311d886d47a756 upstream. The syzbot/syzkaller automated tests found a problem in security_context_to_sid_core() during early boot (before we load the SELinux policy) where we could potentially feed context strings without NUL terminators into the strcmp() function. We already guard against this during normal operation (after the SELinux policy has been loaded) by making a copy of the context strings and explicitly adding a NUL terminator to the end. The patch extends this protection to the early boot case (no loaded policy) by moving the context copy earlier in security_context_to_sid_core(). Reported-by: syzbot Signed-off-by: Paul Moore Reviewed-By: William Roberts Signed-off-by: Greg Kroah-Hartman --- security/selinux/ss/services.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -1406,27 +1406,25 @@ static int security_context_to_sid_core( if (!scontext_len) return -EINVAL; + /* Copy the string to allow changes and ensure a NUL terminator */ + scontext2 = kmemdup_nul(scontext, scontext_len, gfp_flags); + if (!scontext2) + return -ENOMEM; + if (!ss_initialized) { int i; for (i = 1; i < SECINITSID_NUM; i++) { - if (!strcmp(initial_sid_to_string[i], scontext)) { + if (!strcmp(initial_sid_to_string[i], scontext2)) { *sid = i; - return 0; + goto out; } } *sid = SECINITSID_KERNEL; - return 0; + goto out; } *sid = SECSID_NULL; - /* Copy the string so that we can modify the copy as we parse it. */ - scontext2 = kmalloc(scontext_len + 1, gfp_flags); - if (!scontext2) - return -ENOMEM; - memcpy(scontext2, scontext, scontext_len); - scontext2[scontext_len] = 0; - if (force) { /* Save another copy for storing in uninterpreted form */ rc = -ENOMEM;