* Re: [next] Null pointer dereference in mls_compute_sid()
2012-03-22 13:44 ` [next] Null pointer dereference in mls_compute_sid() Eric Paris
@ 2012-03-22 14:55 ` Stephen Smalley
0 siblings, 0 replies; 2+ messages in thread
From: Stephen Smalley @ 2012-03-22 14:55 UTC (permalink / raw)
To: Eric Paris; +Cc: Martin Nyhus, selinux
I'd still be concerned about why a class value of 0 is getting passed
from userspace. Bug in systemd or libselinux?
On Thu, 2012-03-22 at 09:44 -0400, Eric Paris wrote:
> It should be fixed in today's linux-next! I'm so sorry about that!
>
> On Wed, 2012-03-21 at 23:12 +0100, Martin Nyhus wrote:
> > Hi,
> >
> > while running next-20120321 the class passed in to mls_compute_sid()
> > (tclass) is sometimes 0 which leads to a read from
> > policydb.class_val_to_struct[-1] causing a null pointer dereference
> > when cladatum is used (at mls.c:535).
> >
> > The crash happens on every boot, just after mounting the filesystem.
> >
> > Calltrace:
> > security_compute_sid.part.7
> > security_compute_sid
> > security_transition_sid_user
> > ? security_context_to_sid
> > sel_write_create
> > ? might_fault
> > ? _raw_spin_unlock
> > ? sel_write_member
> > selinux_transaction_write
> > vfs_write
> > sys_write
> > system_call_fastpath
> >
> >
> > Martin Nyhus
>
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 2+ messages in thread