linux-kernel - Re: [PATCH v4 2/8] LSM: Maintain a table of LSM attribute data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202301022326.638b5c49-yujie.liu@intel.com>
Date:   Tue, 3 Jan 2023 00:06:50 +0800
From:   kernel test robot <yujie.liu@...el.com>
To:     Casey Schaufler <casey@...aufler-ca.com>
CC:     <oe-lkp@...ts.linux.dev>, <lkp@...el.com>,
        <linux-kernel@...r.kernel.org>,
        <linux-security-module@...r.kernel.org>,
        <casey.schaufler@...el.com>, <paul@...l-moore.com>,
        <casey@...aufler-ca.com>, <jmorris@...ei.org>,
        <keescook@...omium.org>, <john.johansen@...onical.com>,
        <penguin-kernel@...ove.sakura.ne.jp>,
        <stephen.smalley.work@...il.com>, <linux-api@...r.kernel.org>,
        <mic@...ikod.net>
Subject: Re: [PATCH v4 2/8] LSM: Maintain a table of LSM attribute data

Greeting,

FYI, we noticed UBSAN:array-index-out-of-bounds_in_security/security.c due to commit (built with gcc-11):

commit: 541d81106c1f677b6140c5eb894dda23b6422614 ("[PATCH v4 2/8] LSM: Maintain a table of LSM attribute data")
url: https://github.com/intel-lab-lkp/linux/commits/Casey-Schaufler/LSM-Maintain-a-table-of-LSM-attribute-data/20221230-083536
base: https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git 03c4c7f88709fac0e20b6a48357c73d6fc50e544
patch link: https://lore.kernel.org/all/20221229233454.43880-3-casey@schaufler-ca.com/
patch subject: [PATCH v4 2/8] LSM: Maintain a table of LSM attribute data

in testcase: boot

on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


[  335.323207][    T0] UBSAN: array-index-out-of-bounds in security/security.c:529:13
[  335.324261][    T0] index 4 is out of range for type 'lsm_id *[4]'
[  335.324964][    T0] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-rc1-00003-g541d81106c1f #1
[  335.325955][    T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014
[  335.327092][    T0] Call Trace:
[  335.327472][    T0]  <TASK>
[ 335.327802][ T0] dump_stack_lvl (??:?) 
[ 335.328350][ T0] ubsan_epilogue (ubsan.c:?) 
[ 335.328350][ T0] __ubsan_handle_out_of_bounds (??:?) 
[ 335.328350][ T0] ? __register_sysctl_paths (??:?) 
[ 335.328350][ T0] security_add_hooks (??:?) 
[ 335.328350][ T0] safesetid_security_init (lsm.c:?) 
[ 335.328350][ T0] initialize_lsm (security.c:?) 
[ 335.328350][ T0] ordered_lsm_init (security.c:?) 
[ 335.328350][ T0] security_init (??:?) 
[ 335.328350][ T0] start_kernel (??:?) 
[ 335.328350][ T0] secondary_startup_64_no_verify (??:?) 
[  335.328350][    T0]  </TASK>
[  335.328356][    T0] ================================================================================
[  335.329401][    T0] Kernel panic - not syncing: security_add_hooks Too many LSMs registered.
[  335.330386][    T0] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-rc1-00003-g541d81106c1f #1
[  335.331405][    T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014
[  335.332607][    T0] Call Trace:
[  335.332957][    T0]  <TASK>
[ 335.333282][ T0] dump_stack_lvl (??:?) 
[ 335.333799][ T0] panic (??:?) 
[ 335.334242][ T0] security_add_hooks (??:?) 
[ 335.334793][ T0] safesetid_security_init (lsm.c:?) 
[ 335.335426][ T0] initialize_lsm (security.c:?) 
[ 335.335920][ T0] ordered_lsm_init (security.c:?) 
[ 335.336458][ T0] security_init (??:?) 
[ 335.337004][ T0] start_kernel (??:?) 
[ 335.337510][ T0] secondary_startup_64_no_verify (??:?) 
[  335.338178][    T0]  </TASK>


If you fix the issue, kindly add following tag
| Reported-by: kernel test robot <yujie.liu@...el.com>
| Link: https://lore.kernel.org/oe-lkp/202301022326.638b5c49-yujie.liu@intel.com


To reproduce:

        # build kernel
	cd linux
	cp config-6.2.0-rc1-00003-g541d81106c1f .config
	make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules
	make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 INSTALL_MOD_PATH=<mod-install-dir> modules_install
	cd <mod-install-dir>
	find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz


        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email

        # if come across any failure that blocks the test,
        # please remove ~/.lkp and /lkp dir to run from a clean state.


-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests

View attachment "config-6.2.0-rc1-00003-g541d81106c1f" of type "text/plain" (125656 bytes)

View attachment "job-script" of type "text/plain" (4875 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (5644 bytes)