Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
In-Reply-To: <4759b591-6603-7424-1758-fd0d23e6efed@canonical.com>
References: <20170915195620.1561044-1-arnd@arndb.de> <a94bac78-769a-e8bc-9a98-83a401534935@canonical.com>
 <CAK8P3a2SFStvycD4CX+4xtogaoiDXWB0tpeCDKNsYfxD9nDQcw@mail.gmail.com> <4759b591-6603-7424-1758-fd0d23e6efed@canonical.com>
From:   Arnd Bergmann <arnd@arndb.de>
Date:   Mon, 20 Nov 2017 17:05:36 +0100
Message-ID: <CAK8P3a2=SBu6p_xZ61Sv2nnCz2f4Bzv_jpTmGm2F7GGTMkEiow@mail.gmail.com>
Subject: Re: [PATCH] apparmor: initialized returned struct aa_perms
To:     John Johansen <john.johansen@canonical.com>
Cc:     James Morris <james.l.morris@oracle.com>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        Kees Cook <keescook@chromium.org>,
        Stephen Rothwell <sfr@canb.auug.org.au>,
        Seth Arnold <seth.arnold@canonical.com>,
        Michal Hocko <mhocko@suse.com>,
        Vlastimil Babka <vbabka@suse.cz>,
        LSM List <linux-security-module@vger.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, Nov 20, 2017 at 4:47 PM, John Johansen
<john.johansen@canonical.com> wrote:
> On 11/20/2017 06:00 AM, Arnd Bergmann wrote:
>> On Mon, Sep 25, 2017 at 4:29 PM, John Johansen
>> <john.johansen@canonical.com> wrote:
>>> On 09/15/2017 03:55 PM, Arnd Bergmann wrote:
>>>> gcc-4.4 points out suspicious code in compute_mnt_perms, where
>>>> the aa_perms structure is only partially initialized before getting
>>>> returned:
>>>>
>>>> security/apparmor/mount.c: In function 'compute_mnt_perms':
>>>> security/apparmor/mount.c:227: error: 'perms.prompt' is used uninitialized in this function
>>>> security/apparmor/mount.c:227: error: 'perms.hide' is used uninitialized in this function
>>>> security/apparmor/mount.c:227: error: 'perms.cond' is used uninitialized in this function
>>>> security/apparmor/mount.c:227: error: 'perms.complain' is used uninitialized in this function
>>>> security/apparmor/mount.c:227: error: 'perms.stop' is used uninitialized in this function
>>>> security/apparmor/mount.c:227: error: 'perms.deny' is used uninitialized in this function
>>>>
>>>> Returning or assigning partially initialized structures is a bit tricky,
>>>> in particular it is explicitly allowed in c99 to assign a partially
>>>> intialized structure to another, as long as only members are read that
>>>> have been initialized earlier. Looking at what various compilers do here,
>>>> the version that produced the warning copied unintialized stack data,
>>>> while newer versions (and also clang) either set the other members to
>>>> zero or don't update the parts of the return buffer that are not modified
>>>> in the temporary structure, but they never warn about this.
>>>>
>>>> In case of apparmor, it seems better to be a little safer and always
>>>> initialize the aa_perms structure. Most users already do that, this
>>>> changes the remaining ones, including the one instance that I got the
>>>> warning for.
>>>>
>>>> Fixes: fa488437d0f9 ("apparmor: add mount mediation")
>>>> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
>>>
>>> I've pulled this into apparmor-next
>>
>> It apparently never made it into mainline. What happened?
>>
> Its in apparmor-next and is going with today's pull request

Ok, thanks for checking. I see it in linux-next now, but didn't see
it a linux-next tree from early last week, or in mainline.

      Arnd

From 1584600594281238716@xxx Mon Nov 20 15:48:08 +0000 2017
X-GM-THRID: 1578636895757947351
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread