Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <8918e7c6-f70f-9a9a-7acf-5b06bcf53c4a@schaufler-ca.com>
Date:   Tue, 19 Oct 2021 12:53:14 -0700
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.2.0
Subject: Re: [PATCH] Fixing returning a userspace address for return value
Content-Language: en-US
To:     James Morris <jmorris@namei.org>,
        "T. Williams" <tdwilliamsiv@gmail.com>
Cc:     "Serge E. Hallyn" <serge@hallyn.com>,
        linux-security-module@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        Casey Schaufler <casey@schaufler-ca.com>
References: <CADN=F_=tijrY7Lwv2coPcXS04uzEQsUL70=v3wHceGe9p6W7pw@mail.gmail.com>
 <7df6e94f-a4c7-d181-7f9a-165e95b493@namei.org>
From:   Casey Schaufler <casey@schaufler-ca.com>
In-Reply-To: <7df6e94f-a4c7-d181-7f9a-165e95b493@namei.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Length: 2230
Precedence: bulk

On 10/19/2021 11:41 AM, James Morris wrote:
> On Tue, 19 Oct 2021, T. Williams wrote:
>
>> Fixing user memory dereference bug.
>>
>> Signed-off-by: Thelford Williams <tdwilliamsiv@gmail.com>
> Casey, can you check the logic on this?
>
>> ---
>>   security/security.c | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/security/security.c b/security/security.c
>> index 9ffa9e9c5c55..7c41b5d732ab 100644
>> --- a/security/security.c
>> +++ b/security/security.c
>> @@ -1737,6 +1737,8 @@ int security_kernel_read_file(struct file *file, enum
>> kernel_read_file_id id,
>>          int ret;
>>
>>          ret = call_int_hook(kernel_read_file, 0, file, id, contents);
>> +       if (ret > 0)
>> +               return -EINVAL;

Does the failing configuration include a BPF program that might be
invoked for this hook? SELinux is the only traditional security module
that provides a hook, and it never returns a positive value. I don't
see a case where the proposed check makes any sense. If the problem is
in a BPF program it should be fixed there.

>>          if (ret)
>>                  return ret;
>>          return ima_read_file(file, id, contents);
>> -- 
>> 2.25.1
>>
>> This commit is to fix a userspace address dereference found by
>> syzkaller.
>> The crash is triggered by passing a file descriptor to an incorrectly
>> formed kernel module to finit_module.
>>
>> Kernel/module.c:4175 : Within the finit_module, info.len is set to the
>> return value from kernel_read_file_from_fd. This value is then
>> dereferenced by memcmp within module_sig_check from inside load_module.
>> The value is 0xb000000 so the kernel dereferences user memory and kernel
>> panics.
>>
>> To prevent this adding a check from within security_kernel_read_file to
>> make sure call_int_hook doesn't return an address which in the syzkaller
>> program is what causes the return value to be 0xb000000. Then the return
>> value of security_kernel_read_file is returned to kernel_read_file(also
>> in security/security.c) which returns the value to
>> kernel_read_file_from_fd (fs/kernel_read_file.c) and this returns the
>> value into err then being set to info.len causing the dereference when
>> info is passed into load_module.
>>