Re: CVE-2024-40938: landlock: Fix d_parent walk

[Kees Cook <kees@kernel.org>]

On Mon, Jul 15, 2024 at 02:20:59PM +0200, Mickaël Salaün wrote:
> On Mon, Jul 15, 2024 at 01:16:38PM +0200, Greg Kroah-Hartman wrote:
> > On Mon, Jul 15, 2024 at 12:37:53PM +0200, Mickaël Salaün wrote:
> > > Hello,
> > > 
> > > AFAIK, commit 88da52ccd66e ("landlock: Fix d_parent walk") doesn't fix a
> > > security issue but an unexpected case.  The triggered WARN_ON_ONCE() is
> > > just a canary, and this case was correctly handled with defensive
> > > programming and didn't allow to bypass the security policy nor to harm
> > > the kernel.  However, this fix should indeed be backported.
> > 
> > If a WARN_ON() is hit, a machine with panic_on_warn enabled will reboot,
> > hence if there is any way that userspace can hit this, it needs to be
> > issued a CVE, sorry.
> 
> OK, I didn't know about this panic_on_warn rule for CVE.  Out of
> curiosity, panic_on_warn is definitely useful for fuzzing and testing,
> but what is the rational to enable panic_on_warn on production systems?
> It literally transforms a warning message into a system DoS (i.e.
> WARN_ON into BUG_ON).  We should explicitly use BUG_ON() if this is a
> critical unhandled case, right?

We need a way to raise WARN to panic for deployments that have tested
their workloads and want FORTIFY_SOURCE and UBSAN_BOUNDS to actually
perform mitigations instead of just warning. Linus rejected all prior
knobs for this and panic_on_warn (or better yet, kernel.warn_limit
syscall) is used for this purpose.

Userspace actions must never be able to reach a WARN or BUG state:
https://docs.kernel.org/process/deprecated.html#bug-and-bug-on

-- 
Kees Cook