linux-kernel - Re: 2.6.24-rc6-mm1 - git-lblnet.patch and networking horkage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 27 Dec 2007 01:16:25 +1100 (EST)
From:	James Morris <jmorris@...ei.org>
To:	Valdis.Kletnieks@...edu
cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Paul Moore <paul.moore@...com>, linux-kernel@...r.kernel.org,
	Stephen Smalley <sds@...ho.nsa.gov>
Subject: Re: 2.6.24-rc6-mm1 - git-lblnet.patch and networking horkage

On Wed, 26 Dec 2007, James Morris wrote:

> What does the following say ?
> 
> # sestatus  && rpm -q selinux-policy

Don't worry about that -- I reproduced it with Paul Moore's git tree:
git://git.infradead.org/users/pcmoore/lblnet-2.6_testing

(under current -mm, the e1000 driver doesn't find my ethernet card & the 
tcl tests won't run without an external interface).

The offending commit is when SELinux is converted to the new ifindex 
interface:

  9c6ad8f6895db7a517c04c2147cb5e7ffb83a315 is first bad commit
  commit 9c6ad8f6895db7a517c04c2147cb5e7ffb83a315
  Author: Paul Moore <paul.moore@...com>
  Date:   Fri Dec 21 11:44:26 2007 -0500

      SELinux: Convert the netif code to use ifindex values

      [...]

In some case (not yet fully identified -- also happens when avahi starts 
up, although seemingly silently & without obvious issues), SELinux is 
passed an ifindex of 1515870810, which corresponds to 0x5a5a5a5a, the slab 
poison value, suggesting a race in the calling code where we're being 
asked to check an skb which has been freed.

The SELinux code is erroring out before performing an access check 
(perhaps there should be WARN_ON, at least), so this will affect both 
permissive and enforcing mode without generating any log messages.

Andrew: I suggest dropping the patchset from -mm until Paul gets back from 
vacation.

- James
-- 
James Morris
<jmorris@...ei.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/