Re: [PATCH] apparmor: fix out-of-bounds read in unix socket address audit

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] apparmor: fortify_panic() in audit_unix_addr() on 108-byte unix
  path
--

commit d5771717eed480bc696396976af119ef6974188d
Author: Henry Martin <bsdhenrymartin@gmail.com>

apparmor: fix out-of-bounds read in unix socket address audit

This commit replaces audit_log_untrustedstring() with
audit_log_n_untrustedstring() and strnlen() when logging pathname AF_UNIX
socket addresses in audit_unix_addr().

> diff --git a/security/apparmor/net.c b/security/apparmor/net.c
> index a333e6aff9262..10f888c83b897 100644
> --- a/security/apparmor/net.c
> +++ b/security/apparmor/net.c
> @@ -85,7 +85,8 @@ static void audit_unix_addr(struct audit_buffer *ab, const char *str,
>  		audit_log_format(ab, " %s=none", str);
>  	} else if (addr->sun_path[0]) {
>  		audit_log_format(ab, " %s=", str);
> -		audit_log_untrustedstring(ab, addr->sun_path);
> +		audit_log_n_untrustedstring(ab, addr->sun_path,
> +					    strnlen(addr->sun_path, len));

[Severity: High]
Can strnlen(addr->sun_path, len) trigger a fortify_panic() when auditing a
socket bound to a 108-byte (UNIX_PATH_MAX) filesystem pathname?

For a 108-byte pathname, unix_mkname_bsd() writes a trailing NUL byte one
byte past sun_path[107] and returns 111 (108 + offsetof(struct sockaddr_un,
sun_path) + 1), which unix_create_addr() stores in u->addr->len.  When
audit_unix_sk_addr() later passes u->addr->name and u->addr->len to
audit_unix_addr(), len is unix_addr_len(111) = 109.

With CONFIG_FORTIFY_SOURCE=y, strnlen(addr->sun_path, 109) sees p_size =
sizeof(addr->sun_path) = 108, maxlen = 109, and ret = 108, which satisfies
(p_size <= ret && maxlen != ret) and calls fortify_panic().  Clamping the
bound to min_t(size_t, len, sizeof(addr->sun_path)) avoids passing a
maxlen larger than the sun_path array.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106185532.3338123-1-bsdhenrymartin@gmail.com?part=1