All of lore.kernel.org
 help / color / mirror / Atom feed
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Miklos Szeredi <miklos@szeredi.hu>
Cc: Krisztian Litkey <kli@iki.fi>,
	Mimi Zohar <zohar@linux.vnet.ibm.com>,
	linux-unionfs@vger.kernel.org,
	Krisztian Litkey <krisztian.litkey@intel.com>,
	linux-security-module <linux-security-module@vger.kernel.org>,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH v3 1/1] ovl: setxattr: don't deadlock when called from ima_fix_xattr.
Date: Mon, 30 May 2016 17:50:07 +0100	[thread overview]
Message-ID: <20160530165007.GA14480@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20160530141015.GC5758@veci.piliscsaba.szeredi.hu>

	Only tangentially related, but... that bug had been discussed,
without any results: the fallback in ima_d_path() to ->d_name.name is
completely broken.  There is no warranty whatsoever that dentry won't be
renamed, with its earlier (too long to be embedded into dentry itself)
->d_name.name getting freed.  Right under your code.

	Could we please get rid of that thing?  "A message in a near-oom
situation might be less informative than we'd like" is better than
"this code might end up dereferencing freed memory".

	Another similar bug is in ima_collect_measurement() -
        const char *filename = file->f_path.dentry->d_name.name;
	...
                integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
                                    filename, "collect_data", audit_cause,
with no warranty whatsoever that you are not passing a pointer to freed
memory.  The same goes for ima_eventname_init_common() -
        if (event_data->file) {
                cur_filename = event_data->file->f_path.dentry->d_name.name;
                cur_filename_len = strlen(cur_filename);
        } else  
...
        return ima_write_template_field_data(cur_filename, cur_filename_len,
                                             DATA_FMT_STRING, field_data);

  reply	other threads:[~2016-05-30 16:50 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-05-15 18:52 [PATCH 1/1] ovl: setxattr: avoid deadlock when writing IMA xattrs Mimi Zohar
2016-05-15 20:07 ` [PATCH v2 1/1] ovl: setxattr: avoid deadlock when setting IMA xattr Krisztian Litkey
     [not found]   ` <201605161420.u4GEKLHk009316@d03av05.boulder.ibm.com>
2016-05-16 15:13     ` Krisztian Litkey
2016-05-16 20:22       ` Krisztian Litkey
2016-05-18 22:45         ` Mimi Zohar
2016-05-20  6:28           ` [PATCH v3 1/1] ovl: setxattr: don't deadlock when called from ima_fix_xattr Krisztian Litkey
2016-05-20 14:21             ` Mimi Zohar
2016-05-20 16:29               ` Al Viro
2016-05-20 17:00                 ` Mimi Zohar
2016-05-20 20:53                   ` Krisztian Litkey
2016-05-30 14:10                     ` Miklos Szeredi
2016-05-30 16:50                       ` Al Viro [this message]
2016-05-31  2:15                         ` Mimi Zohar
2016-05-31  2:15                         ` Mimi Zohar
2016-05-31  2:15                         ` Mimi Zohar
2016-05-31  2:15                         ` Mimi Zohar
2016-05-31  2:29                       ` Mimi Zohar
2016-05-31  2:29                       ` Mimi Zohar
2016-05-31  2:29                       ` Mimi Zohar
2016-05-31  2:29                       ` Mimi Zohar
2016-05-20 15:18             ` Andy Whitcroft

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160530165007.GA14480@ZenIV.linux.org.uk \
    --to=viro@zeniv.linux.org.uk \
    --cc=kli@iki.fi \
    --cc=krisztian.litkey@intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=linux-unionfs@vger.kernel.org \
    --cc=miklos@szeredi.hu \
    --cc=zohar@linux.vnet.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.