From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7F5DC433F5 for ; Mon, 28 Mar 2022 11:18:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240589AbiC1LUS (ORCPT ); Mon, 28 Mar 2022 07:20:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54146 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240564AbiC1LUR (ORCPT ); Mon, 28 Mar 2022 07:20:17 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AA82755492; Mon, 28 Mar 2022 04:18:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4469861143; Mon, 28 Mar 2022 11:18:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 468B2C340EC; Mon, 28 Mar 2022 11:18:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1648466311; bh=sIfC8IzjPnQADnfqoYQogVIEnZP7501njURyn9RBSZM=; h=From:To:Cc:Subject:Date:From; b=qj44PraXASpeVudm/5dcVcBjh6TnOEwIAhEInA+lTXrWM7UmvsQBif3WMAJqVhbwS VIhnYmtOLxRTl90KRp/lK4keNrJbHQdxpC2aK0pgFsV+TU/1LczEssYOcja5BewOJT vWzNqj5uHya5veEftr+kwd+mZkHQ/Lk/YT+MMY6zXiDikMHfc7Eqi/A7EYy5LBwXKk k27aYPsTqfj3fFahBMhL2w3IZ4VtxRPEZR4BEyVY40bQ8ggwYwM1SfrTDhiZ5o0xTQ f0R1FMDZOU2nJX6df5X96WjNyu+lDqoL9VzWheh6iUAuTrS3aNbwbIx9EVQN7x/4C3 ukNBHR6ViMqoQ== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Casey Schaufler , syzbot+d1e3b1d92d25abf97943@syzkaller.appspotmail.com, James Morris , Paul Moore , Sasha Levin , jmorris@namei.org, serge@hallyn.com, stephen.smalley.work@gmail.com, eparis@parisplace.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Subject: [PATCH AUTOSEL 5.17 01/43] LSM: general protection fault in legacy_parse_param Date: Mon, 28 Mar 2022 07:17:45 -0400 Message-Id: <20220328111828.1554086-1-sashal@kernel.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: From: Casey Schaufler [ Upstream commit ecff30575b5ad0eda149aadad247b7f75411fd47 ] The usual LSM hook "bail on fail" scheme doesn't work for cases where a security module may return an error code indicating that it does not recognize an input. In this particular case Smack sees a mount option that it recognizes, and returns 0. A call to a BPF hook follows, which returns -ENOPARAM, which confuses the caller because Smack has processed its data. The SELinux hook incorrectly returns 1 on success. There was a time when this was correct, however the current expectation is that it return 0 on success. This is repaired. Reported-by: syzbot+d1e3b1d92d25abf97943@syzkaller.appspotmail.com Signed-off-by: Casey Schaufler Acked-by: James Morris Signed-off-by: Paul Moore Signed-off-by: Sasha Levin --- security/security.c | 17 +++++++++++++++-- security/selinux/hooks.c | 5 ++--- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/security/security.c b/security/security.c index 22261d79f333..f101a53a63ed 100644 --- a/security/security.c +++ b/security/security.c @@ -884,9 +884,22 @@ int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc) return call_int_hook(fs_context_dup, 0, fc, src_fc); } -int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param) +int security_fs_context_parse_param(struct fs_context *fc, + struct fs_parameter *param) { - return call_int_hook(fs_context_parse_param, -ENOPARAM, fc, param); + struct security_hook_list *hp; + int trc; + int rc = -ENOPARAM; + + hlist_for_each_entry(hp, &security_hook_heads.fs_context_parse_param, + list) { + trc = hp->hook.fs_context_parse_param(fc, param); + if (trc == 0) + rc = 0; + else if (trc != -ENOPARAM) + return trc; + } + return rc; } int security_sb_alloc(struct super_block *sb) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 5b6895e4fc29..371f67a37f9a 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2860,10 +2860,9 @@ static int selinux_fs_context_parse_param(struct fs_context *fc, return opt; rc = selinux_add_opt(opt, param->string, &fc->security); - if (!rc) { + if (!rc) param->string = NULL; - rc = 1; - } + return rc; } -- 2.34.1