linux-kernel - Re: WARNING in __proc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a559bbb6-0db4-2b71-b363-792d88d7eef7@gmail.com>
Date:   Fri, 9 Mar 2018 14:56:08 -0800
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Cong Wang <xiyou.wangcong@...il.com>,
        syzbot <syzbot+0502b00edac2a0680b61@...kaller.appspotmail.com>
Cc:     coreteam@...filter.org, David Miller <davem@...emloft.net>,
        Florian Westphal <fw@...len.de>,
        Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>,
        LKML <linux-kernel@...r.kernel.org>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>,
        netfilter-devel@...r.kernel.org,
        Pablo Neira Ayuso <pablo@...filter.org>,
        syzkaller-bugs@...glegroups.com
Subject: Re: WARNING in __proc_create



On 03/09/2018 02:48 PM, Cong Wang wrote:
> On Fri, Mar 9, 2018 at 1:59 PM, syzbot
> <syzbot+0502b00edac2a0680b61@...kaller.appspotmail.com> wrote:
>> Hello,
>>
>> syzbot hit the following crash on net-next commit
>> 617aebe6a97efa539cc4b8a52adccd89596e6be0 (Sun Feb 4 00:25:42 2018 +0000)
>> Merge tag 'usercopy-v4.16-rc1' of
>> git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
>>
>> So far this crash happened 12 times on net-next, upstream.
>> C reproducer is attached.
>> syzkaller reproducer is attached.
>> Raw console output is attached.
>> compiler: gcc (GCC) 7.1.1 20170620
>> .config is attached.
>>
>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>> Reported-by: syzbot+0502b00edac2a0680b61@...kaller.appspotmail.com
>> It will help syzbot understand when the bug is fixed. See footer for
>> details.
>> If you forward the report, please keep this part and the footer.
>>
>> audit: type=1400 audit(1518223777.419:7): avc:  denied  { map } for
>> pid=4159 comm="syzkaller598581" path="/root/syzkaller598581546" dev="sda1"
>> ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
>> tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
>> ------------[ cut here ]------------
>> name len 0
>> WARNING: CPU: 0 PID: 4159 at fs/proc/generic.c:354 __proc_create+0x696/0x880
>> fs/proc/generic.c:354
> 
> We need to reject empty names.
> 

I sent a patch a while back, but Pablo/Florian wanted more than that 
simple fix.

We also need to filter special characters like '/'

Or maybe I am mixing with something else.