lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Sat, 16 Sep 2017 21:18:56 +0300
From:   Konstantin Khlebnikov <>
To:     linux-kernel <>
Cc:     Serge Hallyn <>,
        James Morris <>,
        LSM List <>
Subject: [BUG] security_release_secctx seems broken

I've got this kmemleak splat

unreferenced object 0xffff880f687ff6a8 (size 32):
   comm "cp", pid 4279, jiffies 4295784487 (age 2866.296s)
   hex dump (first 32 bytes):
     01 00 00 02 02 00 08 00 00 00 00 00 00 00 00 00  ................
     00 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  .....kkkkkkkkkk.
     [<ffffffff8192d77a>] kmemleak_alloc+0x4a/0xa0
     [<ffffffff8125b721>] __kmalloc_track_caller+0x171/0x280
     [<ffffffff812125c7>] krealloc+0xa7/0xc0
     [<ffffffff812abb2d>] vfs_getxattr_alloc+0xbd/0x110
     [<ffffffff813ba789>] cap_inode_getsecurity+0x79/0x200
     [<ffffffff813be4d2>] security_inode_getsecurity+0x52/0x80
     [<ffffffff812aad1a>] xattr_getsecurity+0x3a/0xa0
     [<ffffffff812aadf4>] vfs_getxattr+0x74/0xa0
     [<ffffffff812ab27e>] getxattr+0x9e/0x170
     [<ffffffff812abd2a>] SyS_fgetxattr+0x5a/0x90
     [<ffffffff8193a67b>] entry_SYSCALL_64_fastpath+0x1e/0xae
     [<ffffffffffffffff>] 0xffffffffffffffff

allocated in  xattr_getsecurity() security_inode_getsecurity() -> cap_inode_getsecurity()
should be freed by security_release_secctx() but there is no release_secctx hook.

I don't know details about modern security models stack but it
seems security_release_secctx() have to know which layer owns
secdata to free it property: selinux just calls kfree,
capability_hooks should do the same, but other modules returns
non-freeable pointers. Currently security_release_secctx() calls
release_secctx for all models, this is obviously wrong.

Powered by blists - more mailing lists