linux-kernel - RE: Recent VFS/LSM patches cause Kernel panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <PU1P153MB0169179D2E7127E2F408CCE2BFBF0@PU1P153MB0169.APCP153.PROD.OUTLOOK.COM>
Date:   Thu, 20 Dec 2018 20:02:36 +0000
From:   Dexuan Cui <decui@...rosoft.com>
To:     'David Howells' <dhowells@...hat.com>,
        'John Johansen' <john.johansen@...onical.com>,
        'Al Viro' <viro@...iv.linux.org.uk>,
        'James Morris' <jmorris@...ei.org>,
        James Morris <James.Morris@...rosoft.com>,
        "'Serge E. Hallyn'" <serge@...lyn.com>,
        'Alexander Viro' <viro@...iv.linux.org.uk>
CC:     "Adrian Vladu (Cloudbase Solutions SRL)" <v-advlad@...rosoft.com>,
        Michael Kelley <mikelley@...rosoft.com>,
        Sasha Levin <Alexander.Levin@...rosoft.com>,
        "'apparmor@...ts.ubuntu.com'" <apparmor@...ts.ubuntu.com>,
        "'linux-security-module@...r.kernel.org'" 
        <linux-security-module@...r.kernel.org>,
        "'linux-fsdevel@...r.kernel.org'" <linux-fsdevel@...r.kernel.org>,
        "'linux-kernel@...r.kernel.org'" <linux-kernel@...r.kernel.org>,
        'Tejun Heo' <tj@...nel.org>
Subject: RE: Recent VFS/LSM patches cause Kernel panic - not syncing: Can't
 create rootfs

> From: Dexuan Cui
> Sent: Wednesday, December 19, 2018 8:30 PM
> 
> Hi,
> We started to see a "Can't create rootfs" panic with linux-next's
> next-20181218 and next-20181219. Note: next-20181217 is good.
> 
> Our test team found the first bad commit by git-bisect:
> 013c7af575e5 ("vfs: Implement a filesystem superblock creation/configuration
> context")
> 
> I had a look and I think another patch also helped to cause the panic:
> c36d02347290 ("apparmor: Implement security hooks for the new mount API")
> 
> My finding is: the panic happens because
> start_kernel() -> vfs_caches_init() -> mnt_init() ->
> sysfs_init() -> register_filesystem() -> init_mount_tree() ->
> vfs_kern_mount(type, 0, "rootfs", NULL) -> vfs_get_tree() ->
> security_sb_set_mnt_opts(sb, fc->security, 0, NULL) returns -EOPNOTSUPP:
> 
> This means: fc->security is not NULL in
> security_sb_set_mnt_opts(sb, fc->security, 0, NULL), and the
> security_hook_heads.FUNC is empty in call_int_hook().
> 
> The fc->security is assigned in this function (i.e. the line "fc->security = afc;" ):
> 
> static int apparmor_fs_context_parse_param(struct fs_context *fc,

Well, obviously David Howells <dhowells@...hat.com> has fixed the issue in
the updated version of the patch by adding a dummy apparmor_set_mnt_opts():

>From 8c5887f849301a5e00fa4b5e5ea7a3feae16b02d
From: David Howells <dhowells@...hat.com>
Date: Thu, 1 Nov 2018 23:07:24 +0000
Subject: apparmor: Implement security hooks for the new mount API
(https://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git/commit/?h=for-next&id=8c5887f849301a5e00fa4b5e5ea7a3feae16b02d )

I expect the fix will be in linux-next soon, probably tomorrow.

Thanks!
-- Dexuan