Received: by 10.213.65.68 with SMTP id h4csp1799651imn; Mon, 19 Mar 2018 13:36:13 -0700 (PDT) X-Google-Smtp-Source: AG47ELs+BBmaEEAKonectJq+OvHpBTEqcd+yyxObPIMZzQkSTHJjviPTq6zlZtVMN/LUWE8+UmJ2 X-Received: by 10.101.88.4 with SMTP id g4mr10048602pgr.146.1521491773789; Mon, 19 Mar 2018 13:36:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1521491773; cv=none; d=google.com; s=arc-20160816; b=vOxwj65RPBgkLjer6qRnJVuJ0cgGE7CS/dU86mghEkE4ikpmJ6f28BoEVsB7Uzwil4 MdYb43sHBXvFXfVP+DMqjM10ka0Xi9hLvjTnJl3TGwLpg+q7Qg+nf2EDIYGLkyHwro67 oeU+vvbA/6Gf3fxTo5EsIW5GidltvHP1tv5NCukKIwgghal9oJdR7Ie2DfWuj1AtYAlA 4nbdI2fj8XG0K6TytIhrYePxw0LB5ApmRsoIVUEq+SVabZSxju07tczjlKxXy5X1Rts+ 3EBqU+6vlxbYz5BeGbtD+tB82GhxrtBV/AT5tanQfbcoEQ5gGelu80ISE1Z+TmyGNxWz pEag== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=GKCC/ejGbwjdg8nzTcSow8nqU2/PO7LoLfMhct2n3Z4=; b=UKOfof/7MTnGmZ7s3BHlCFB/W7Vnh1zA3oKpMkTP3b5aBLLN6jPHSXuDXSlwkIgIUn TwllQKzCgGWnJeSiploKDjbclzJfkbaXMjaP93gpUEdvY32fFk4ifgJFVvBlCA9ztlMk IGeFIjBWD/zkfx9T2LsvIJfFS7vEX/5iUREepNVHZTC4dkWcDw4F9IWHXBj/oM5zYlQh bpjBwi6oF5hO71brhKI4R4LbMNUjMGtfYwiUClBX20Ev6w8iMMFe0iIBiqJlR85fEwS1 P7MQb53bE5J6jo6MdSkDjWxHEqTLgiznyFBYKzVShdhCpD79tWBl0Vux4jZGmKQIX8eE WxuQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id p7si12829pgs.203.2018.03.19.13.35.58; Mon, 19 Mar 2018 13:36:13 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1031941AbeCSUdy (ORCPT + 99 others); Mon, 19 Mar 2018 16:33:54 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:42630 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1030439AbeCSSMJ (ORCPT ); Mon, 19 Mar 2018 14:12:09 -0400 Received: from localhost (LFbn-1-12247-202.w90-92.abo.wanadoo.fr [90.92.61.202]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 8DC2811E9; Mon, 19 Mar 2018 18:12:08 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Potapenko , Eric Dumazet , Paul Moore , Sasha Levin Subject: [PATCH 4.4 010/134] selinux: check for address length in selinux_socket_bind() Date: Mon, 19 Mar 2018 19:04:53 +0100 Message-Id: <20180319171850.581238884@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180319171849.024066323@linuxfoundation.org> References: <20180319171849.024066323@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alexander Potapenko [ Upstream commit e2f586bd83177d22072b275edd4b8b872daba924 ] KMSAN (KernelMemorySanitizer, a new error detection tool) reports use of uninitialized memory in selinux_socket_bind(): ================================================================== BUG: KMSAN: use of unitialized memory inter: 0 CPU: 3 PID: 1074 Comm: packet2 Tainted: G B 4.8.0-rc6+ #1916 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 0000000000000000 ffff8800882ffb08 ffffffff825759c8 ffff8800882ffa48 ffffffff818bf551 ffffffff85bab870 0000000000000092 ffffffff85bab550 0000000000000000 0000000000000092 00000000bb0009bb 0000000000000002 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [] dump_stack+0x238/0x290 lib/dump_stack.c:51 [] kmsan_report+0x276/0x2e0 mm/kmsan/kmsan.c:1008 [] __msan_warning+0x5b/0xb0 mm/kmsan/kmsan_instr.c:424 [] selinux_socket_bind+0xf41/0x1080 security/selinux/hooks.c:4288 [] security_socket_bind+0x1ec/0x240 security/security.c:1240 [] SYSC_bind+0x358/0x5f0 net/socket.c:1366 [] SyS_bind+0x82/0xa0 net/socket.c:1356 [] do_syscall_64+0x58/0x70 arch/x86/entry/common.c:292 [] entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.o:? chained origin: 00000000ba6009bb [] save_stack_trace+0x27/0x50 arch/x86/kernel/stacktrace.c:67 [< inline >] kmsan_save_stack_with_flags mm/kmsan/kmsan.c:322 [< inline >] kmsan_save_stack mm/kmsan/kmsan.c:337 [] kmsan_internal_chain_origin+0x118/0x1e0 mm/kmsan/kmsan.c:530 [] __msan_set_alloca_origin4+0xc3/0x130 mm/kmsan/kmsan_instr.c:380 [] SYSC_bind+0x129/0x5f0 net/socket.c:1356 [] SyS_bind+0x82/0xa0 net/socket.c:1356 [] do_syscall_64+0x58/0x70 arch/x86/entry/common.c:292 [] return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.o:? origin description: ----address@SYSC_bind (origin=00000000b8c00900) ================================================================== (the line numbers are relative to 4.8-rc6, but the bug persists upstream) , when I run the following program as root: ======================================================= #include #include #include int main(int argc, char *argv[]) { struct sockaddr addr; int size = 0; if (argc > 1) { size = atoi(argv[1]); } memset(&addr, 0, sizeof(addr)); int fd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP); bind(fd, &addr, size); return 0; } ======================================================= (for different values of |size| other error reports are printed). This happens because bind() unconditionally copies |size| bytes of |addr| to the kernel, leaving the rest uninitialized. Then security_socket_bind() reads the IP address bytes, including the uninitialized ones, to determine the port, or e.g. pass them further to sel_netnode_find(), which uses them to calculate a hash. Signed-off-by: Alexander Potapenko Acked-by: Eric Dumazet [PM: fixed some whitespace damage] Signed-off-by: Paul Moore Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- security/selinux/hooks.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4124,10 +4124,18 @@ static int selinux_socket_bind(struct so u32 sid, node_perm; if (family == PF_INET) { + if (addrlen < sizeof(struct sockaddr_in)) { + err = -EINVAL; + goto out; + } addr4 = (struct sockaddr_in *)address; snum = ntohs(addr4->sin_port); addrp = (char *)&addr4->sin_addr.s_addr; } else { + if (addrlen < SIN6_LEN_RFC2133) { + err = -EINVAL; + goto out; + } addr6 = (struct sockaddr_in6 *)address; snum = ntohs(addr6->sin6_port); addrp = (char *)&addr6->sin6_addr.s6_addr;