From mboxrd@z Thu Jan 1 00:00:00 1970 From: Casey Schaufler Subject: Re: [Fix kernel crash in cipso_v4_sock_delattr ] Date: Mon, 30 Mar 2015 10:25:47 -0700 Message-ID: <5519871B.5020402@schaufler-ca.com> References: <1603159082.92241427713739372.JavaMail.weblogic@epmlwas01c> <129817526.SFnNKPuWia@sifl> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Cc: "davem@davemloft.net" , "netdev@vger.kernel.org" , "linux-kernel@vger.kernel.org" , Vaneet Narang , AJEET YADAV , Casey Schaufler To: Paul Moore , maninder1.s@samsung.com Return-path: In-Reply-To: <129817526.SFnNKPuWia@sifl> Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On 3/30/2015 4:32 AM, Paul Moore wrote: > On Monday, March 30, 2015 11:09:00 AM Maninder Singh wrote: >> Dear All, >> we found One Kernel Crash issue in cipso_v4_sock_delattr :- >> As Cipso supports only inet sockets so cipso_v4_sock_delattr will crash when >> try to access any other socket type. cipso_v4_sock_delattr access >> sk_inet->inet_opt which may contain not NULL but invalid address. we found >> this issue with netlink socket.(reproducible by trinity using sendto system >> call .) > Hello, > > First, please go read the Documentation/SubmittingPatches from the kernel > sources; your patch needs to be resubmitted and the instructions in that file > will show you how to do it correctly next time. > > Second, this appears to only affect Smack based systems, yes? SELinux based > systems should have the proper checking in place to prevent this (the checks > are handled in the LSM). This looks like a problem that was fixed some time ago. The current Smack code clearly checks for this. What kernel version are you testing against? > That said, it probably wouldn't hurt to add the > extra checking to netlbl_sock_delattr(). If you properly resubmit your patch > I'll ACK it. > > -Paul >