Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 23 Jun 2022 10:09:48 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     kbuild@lists.01.org, Casey Schaufler <casey@schaufler-ca.com>,
        casey.schaufler@intel.com, jmorris@namei.org,
        linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc:     lkp@intel.com, kbuild-all@lists.01.org, casey@schaufler-ca.com,
        linux-audit@redhat.com, keescook@chromium.org,
        john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp,
        paul@paul-moore.com, stephen.smalley.work@gmail.com,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH v36 18/33] LSM: Use lsmcontext in
 security_dentry_init_security
Message-ID: <202206230827.rGKbTxmu-lkp@intel.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220609230146.319210-19-casey@schaufler-ca.com>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?IKM/7mxrzP+VpgTN4Sbwr1JyNEu+uMTx0VwrqIAuz3jdCKovfb2QzM8h6rEu?=
 =?us-ascii?Q?dPxLDfHpxuqzOqfhYWAHe+CAPWXeJvwNbt9XJGm2VAQKww1ek0h+AC5ybe8e?=
 =?us-ascii?Q?VcTJ8RyDRJypgjtzvAH8WqAaVa2y4OrNECdkVUEZ9puFqb7OLOzOAdiuH/sw?=
 =?us-ascii?Q?D97VjRYwdcaLBomsOxbyarP5ugqeXs0BLI0NoXbDU7buqhDTK9S09KT4MThB?=
 =?us-ascii?Q?GXgz3/Ut5dOUU+cSdMEQLgN4IDa49REYzvs1Kn8Zr43Lu5ohH6DSd6uqB3EH?=
 =?us-ascii?Q?LogV4YbPV+wXaKChSoeGzPmJugZHriD5em39Ghuyl2kYJ9HaXeNdEjYiMgzS?=
 =?us-ascii?Q?Zvbako7813hM7ixt/4rGE2irFSk9TtmI82JsdnbPWD/U3JzaUkwYAfx/cYoE?=
 =?us-ascii?Q?IPz8HY0poPVtY+baNl87AHoTxDf1s62kbpMSv37bMMPwEYYwfz/BaTAlRb7G?=
 =?us-ascii?Q?LHRnmmzbE+fX9F6znLnuEH4JNcbgazV0+yiqaf2vVz/8+eeOlH9T/CjwaNO/?=
 =?us-ascii?Q?C2NcH9edyUbOHT88eDmaI4Er04XgtNAr2EjvxJgxuKw19x/pgnprzpt11yY8?=
 =?us-ascii?Q?EgHqTrSW+MM3zWAXr52doPWWJl+9TLAPDbAzdtsug5UhujZPEl3R9nukMUED?=
 =?us-ascii?Q?9DP2PRoKmeY+96C1dJs36OdU82d8KoOzjXFNvBMXmY7IxZcVYKW/axQ2+Hca?=
 =?us-ascii?Q?dq50YXU96W3HnxA9Zn4o8WU6cdD/DQex7j2i6teXqTzGSEJAaKc2ATsb1Kr2?=
 =?us-ascii?Q?LQheQp9JSO2uGdimnVbcR8gNZNJ26ofwGwc/cOJ/JFulxvX75kxYtJ/XYxJn?=
 =?us-ascii?Q?64q2QnSrt7fY/1Yx6WLPP46mW3HNfFUgM4gJyL3ncjDFn0HZLXORvgfifdsd?=
 =?us-ascii?Q?7XdvpczzeH082Sv8OYp0gdiOdtjLJHGC91K+IZ7sxtIg+yr/jRIWdEkGAlCN?=
 =?us-ascii?Q?drE2dS2GETWuvuiOE7zoe7DgamPMSNJn9Nr0FY5KIW7g6cwacFHbFQk7Kypb?=
 =?us-ascii?Q?FXuVF/DRRz3lhQK61r3zLd/WD2s5nwhmCnEFH3byZC8IkvPq79rj0afXJ1a5?=
 =?us-ascii?Q?uB4cTm1V3BJGHf5EYk7+nJCm3jpZpmXuZo8RN7nJ2B07+bxpibI9ByslGOx4?=
 =?us-ascii?Q?OSxzV8FdskAeKmc+CEo3rvNLVNIytFK4aZC9mzr1ClS29ytcmL2xOdu+93IL?=
 =?us-ascii?Q?G6KRIlENbN5lR0Yhe/caK6qOybQWU2fzzKwt7ST17Zbyklsq5+gdRX3CyUEs?=
 =?us-ascii?Q?xMaERM0KWkvvc75EiGiaPQZF6d9CF6K2UZjW0y2iNUchB/W+lQrC5t42UzGA?=
 =?us-ascii?Q?5z6EY0JTeLG7eD1+LbAElB+QWAy5PqMrtd2fYZG3pBmXGhDStesJKXR7ZGpK?=
 =?us-ascii?Q?1dkvvY+PKj57OsZahRMtgm3XbsWoSIm1Teu51GlW7RhCU/H8JjNF6lfyFpMK?=
 =?us-ascii?Q?WUM7wb3SGmrJ44kB4bWU5UByM2ZTn6pUZhISCuPJ6Rx16efYlc01Cu9N8vLX?=
 =?us-ascii?Q?6lq/XmYhA1yrk7s9Q5ygz/o0rhq3SoG3QzabsVLTjO4R+hPDlMOJ30hZVO3o?=
 =?us-ascii?Q?eaMXepG7jSi5k0jNA8vl3k5IvzqvRjYu44xWb/cNkzSr+eHMM0Knazne88p4?=
 =?us-ascii?Q?PQ=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b2642dbf-62a5-4b9e-097d-08da54e76b7d
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Jun 2022 07:10:14.8256
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: MtplTeBrgBUJqDtSEFf6FVZSxrne39xF98u591mp5MBXb7SvsSmDzohofJkX7Jzpyl+0OWRpCDYgJoGXBRQ9RI9VyV3SrmHdaSRmGzewuoM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR10MB1566
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517,18.0.883
 definitions=2022-06-23_03:2022-06-22,2022-06-23 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 malwarescore=0
 mlxlogscore=999 suspectscore=0 adultscore=0 phishscore=0 bulkscore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2204290000 definitions=main-2206230027
X-Proofpoint-GUID: mSq6sqN8LRtAG8-Ft7VrYwTJI4RhKNBd
X-Proofpoint-ORIG-GUID: mSq6sqN8LRtAG8-Ft7VrYwTJI4RhKNBd
X-Spam-Status: No, score=-1.3 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FAKE_REPLY_C,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Casey,

url:    https://github.com/intel-lab-lkp/linux/commits/Casey-Schaufler/integrity-disassociate-ima_filter_rule-from-security_audit_rule/20220610-080129
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git next
config: parisc-randconfig-m031-20220622 (https://download.01.org/0day-ci/archive/20220623/202206230827.rGKbTxmu-lkp@intel.com/config)
compiler: hppa-linux-gcc (GCC) 11.3.0

If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

New smatch warnings:
fs/fuse/dir.c:484 get_security_context() error: uninitialized symbol 'name'.

Old smatch warnings:
fs/fuse/dir.c:503 get_security_context() warn: is 'ptr' large enough for 'struct fuse_secctx'? 0

vim +/name +484 fs/fuse/dir.c

3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  462  static int get_security_context(struct dentry *entry, umode_t mode,
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  463  				void **security_ctx, u32 *security_ctxlen)
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  464  {
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  465  	struct fuse_secctx *fctx;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  466  	struct fuse_secctx_header *header;
86d33e271bed73 Casey Schaufler 2022-06-09  467  	struct lsmcontext lsmctx;
                                                        ^^^^^^^^^^^^^^^^^^^^^^^^

86d33e271bed73 Casey Schaufler 2022-06-09  468  	void *ptr;
86d33e271bed73 Casey Schaufler 2022-06-09  469  	u32 total_len = sizeof(*header);
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  470  	int err, nr_ctx = 0;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  471  	const char *name;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  472  	size_t namelen;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  473  
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  474  	err = security_dentry_init_security(entry, mode, &entry->d_name,
86d33e271bed73 Casey Schaufler 2022-06-09  475  					    &name, &lsmctx);
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  476  	if (err) {
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  477  		if (err != -EOPNOTSUPP)

Imagine "err == -EOPNOTSUPP".

3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  478  			goto out_err;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  479  		/* No LSM is supporting this security hook. Ignore error */
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  480  	}
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  481  
86d33e271bed73 Casey Schaufler 2022-06-09  482  	if (lsmctx.len) {

Then actually "lsmctx.len" is uninitialized.  Everything breaks after
that.

3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  483  		nr_ctx = 1;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11 @484  		namelen = strlen(name) + 1;
                                                                                 ^^^^
Warning.

3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  485  		err = -EIO;
86d33e271bed73 Casey Schaufler 2022-06-09  486  		if (WARN_ON(namelen > XATTR_NAME_MAX + 1 ||
86d33e271bed73 Casey Schaufler 2022-06-09  487  		    lsmctx.len > S32_MAX))
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  488  			goto out_err;
86d33e271bed73 Casey Schaufler 2022-06-09  489  		total_len += FUSE_REC_ALIGN(sizeof(*fctx) + namelen +
86d33e271bed73 Casey Schaufler 2022-06-09  490  					    lsmctx.len);
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  491  	}
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  492  
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  493  	err = -ENOMEM;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  494  	header = ptr = kzalloc(total_len, GFP_KERNEL);
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  495  	if (!ptr)
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  496  		goto out_err;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  497  
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  498  	header->nr_secctx = nr_ctx;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  499  	header->size = total_len;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  500  	ptr += sizeof(*header);
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  501  	if (nr_ctx) {
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  502  		fctx = ptr;
86d33e271bed73 Casey Schaufler 2022-06-09  503  		fctx->size = lsmctx.len;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  504  		ptr += sizeof(*fctx);
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  505  
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  506  		strcpy(ptr, name);
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  507  		ptr += namelen;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  508  
86d33e271bed73 Casey Schaufler 2022-06-09  509  		memcpy(ptr, lsmctx.context, lsmctx.len);
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  510  	}
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  511  	*security_ctxlen = total_len;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  512  	*security_ctx = header;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  513  	err = 0;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  514  out_err:
86d33e271bed73 Casey Schaufler 2022-06-09  515  	if (nr_ctx)
86d33e271bed73 Casey Schaufler 2022-06-09  516  		security_release_secctx(&lsmctx);
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  517  	return err;
3e2b6fdbdc9ab5 Vivek Goyal     2021-11-11  518  }

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp