Zubin Mithra c8a1685aa3 apparmor: Fix uninitialized value in aa_split_fqname ... [ Upstream commit 250f2da49cb8e582215a65c03f50e8ddf5cd119c ] Syzkaller reported a OOB-read with the stacktrace below. This occurs inside __aa_lookupn_ns as `n` is not initialized. `n` is obtained from aa_splitn_fqname. In cases where `name` is invalid, aa_splitn_fqname returns without initializing `ns_name` and `ns_len`. Fix this by always initializing `ns_name` and `ns_len`. __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430 memcmp+0xe3/0x160 lib/string.c:861 strnstr+0x4b/0x70 lib/string.c:934 __aa_lookupn_ns+0xc1/0x570 security/apparmor/policy_ns.c:209 aa_lookupn_ns+0x88/0x1e0 security/apparmor/policy_ns.c:240 aa_fqlookupn_profile+0x1b9/0x1010 security/apparmor/policy.c:468 fqlookupn_profile+0x80/0xc0 security/apparmor/label.c:1844 aa_label_strn_parse+0xa3a/0x1230 security/apparmor/label.c:1908 aa_label_parse+0x42/0x50 security/apparmor/label.c:1943 aa_change_profile+0x513/0x3510 security/apparmor/domain.c:1362 apparmor_setprocattr+0xaa4/0x1150 security/apparmor/lsm.c:658 security_setprocattr+0x66/0xc0 security/security.c:1298 proc_pid_attr_write+0x301/0x540 fs/proc/base.c:2555 __vfs_write+0x119/0x9f0 fs/read_write.c:485 vfs_write+0x1fc/0x560 fs/read_write.c:549 ksys_write+0x101/0x260 fs/read_write.c:598 __do_sys_write fs/read_write.c:610 [inline] __se_sys_write fs/read_write.c:607 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:607 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: 3b0aaf5866 ("apparmor: add lib fn to find the "split" for fqnames") Reported-by: syzbot+61e4b490d9d2da591b50@syzkaller.appspotmail.com Signed-off-by: Zubin Mithra <zsm@chromium.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2018-11-27 16:13:00 +01:00
..
include	apparmor: Check buffer bounds when mapping permissions mask	2018-07-19 16:24:43 -07:00
.gitignore
apparmorfs.c	apparmor: Fully initialize aa_perms struct when answering userspace query	2018-07-19 16:29:13 -07:00
audit.c
capability.c
crypto.c
domain.c	apparmor: Fix failure to audit context info in build_change_hat	2018-07-20 03:25:25 -07:00
file.c	apparmor: Check buffer bounds when mapping permissions mask	2018-07-19 16:24:43 -07:00
ipc.c
Kconfig
label.c
lib.c	apparmor: Fix uninitialized value in aa_split_fqname	2018-11-27 16:13:00 +01:00
lsm.c	->file_open(): lose cred argument	2018-07-12 10:04:15 -04:00
Makefile
match.c
mount.c
net.c
nulldfa.in
path.c
policy_ns.c	apparmor: fix an error code in __aa_create_ns()	2018-08-21 16:24:56 -07:00
policy_unpack.c	apparmor: remove no-op permission check in policy_unpack	2018-08-22 18:44:42 -07:00
policy.c
procattr.c
resource.c
secid.c	apparmor: fix bad debug check in apparmor_secid_to_secctx()	2018-09-03 11:15:29 -07:00
stacksplitdfa.in
task.c