linux-kernel - Re: [PATCH v2] apparmor: Fix use-after-free in aa_audit_rule

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <201910241438.0RkF9eF9%lkp@intel.com>
Date:   Thu, 24 Oct 2019 14:20:53 +0800
From:   kbuild test robot <lkp@...el.com>
To:     Navid Emamdoost <navid.emamdoost@...il.com>
Cc:     kbuild-all@...ts.01.org, john.johansen@...onical.com,
        emamd001@....edu, smccaman@....edu, kjlu@....edu,
        Navid Emamdoost <navid.emamdoost@...il.com>,
        James Morris <jmorris@...ei.org>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] apparmor: Fix use-after-free in aa_audit_rule_init

Hi Navid,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on security/next-testing]
[cannot apply to v5.4-rc4 next-20191023]
[if your patch is applied to the wrong git tree, please drop us a note to help
improve the system. BTW, we also suggest to use '--base' option to specify the
base tree in git format-patch, please see https://stackoverflow.com/a/37406982]

url:    https://github.com/0day-ci/linux/commits/Navid-Emamdoost/apparmor-Fix-use-after-free-in-aa_audit_rule_init/20191024-123239
base:   https://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next-testing
config: nds32-allyesconfig (attached as .config)
compiler: nds32le-linux-gcc (GCC) 8.1.0
reproduce:
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # save the attached .config to linux build tree
        GCC_VERSION=8.1.0 make.cross ARCH=nds32 

If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@...el.com>

All warnings (new ones prefixed by >>):

   security/apparmor/audit.c: In function 'aa_audit_rule_init':
>> security/apparmor/audit.c:200:13: warning: initialization of 'int' from 'struct aa_label *' makes integer from pointer without a cast [-Wint-conversion]
      int err = rule->label;
                ^~~~
   security/apparmor/audit.c:202:18: warning: passing argument 1 of 'PTR_ERR' makes pointer from integer without a cast [-Wint-conversion]
      return PTR_ERR(err);
                     ^~~
   In file included from include/linux/rwsem.h:18,
                    from include/linux/key.h:18,
                    from include/linux/cred.h:13,
                    from include/linux/sched/signal.h:10,
                    from include/linux/ptrace.h:7,
                    from include/linux/audit.h:13,
                    from security/apparmor/audit.c:11:
   include/linux/err.h:29:61: note: expected 'const void *' but argument is of type 'int'
    static inline long __must_check PTR_ERR(__force const void *ptr)
                                                    ~~~~~~~~~~~~^~~

vim +200 security/apparmor/audit.c

   177	
   178	int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
   179	{
   180		struct aa_audit_rule *rule;
   181	
   182		switch (field) {
   183		case AUDIT_SUBJ_ROLE:
   184			if (op != Audit_equal && op != Audit_not_equal)
   185				return -EINVAL;
   186			break;
   187		default:
   188			return -EINVAL;
   189		}
   190	
   191		rule = kzalloc(sizeof(struct aa_audit_rule), GFP_KERNEL);
   192	
   193		if (!rule)
   194			return -ENOMEM;
   195	
   196		/* Currently rules are treated as coming from the root ns */
   197		rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
   198					     GFP_KERNEL, true, false);
   199		if (IS_ERR(rule->label)) {
 > 200			int err = rule->label;
   201			aa_audit_rule_free(rule);
   202			return PTR_ERR(err);
   203		}
   204	
   205		*vrule = rule;
   206		return 0;
   207	}
   208	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

Download attachment ".config.gz" of type "application/gzip" (52456 bytes)