linux-kernel - Re: [PATCH] smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8f6524bc-1695-421c-acc6-a31528e84ab3@schaufler-ca.com>
Date: Tue, 3 Sep 2024 08:38:23 -0700
From: Casey Schaufler <casey@...aufler-ca.com>
To: Jiawei Ye <jiawei.ye@...mail.com>, paul@...l-moore.com,
 jmorris@...ei.org, serge@...lyn.com, pawan.kumar.gupta@...ux.intel.com
Cc: linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org,
 Casey Schaufler <casey@...aufler-ca.com>
Subject: Re: [PATCH] smackfs: Use rcu_assign_pointer() to ensure safe
 assignment in smk_set_cipso

On 9/2/2024 1:47 AM, Jiawei Ye wrote:
> In the `smk_set_cipso` function, the `skp->smk_netlabel.attr.mls.cat`
> field is directly assigned to a new value without using the appropriate
> RCU pointer assignment functions. According to RCU usage rules, this is
> illegal and can lead to unpredictable behavior, including data
> inconsistencies and impossible-to-diagnose memory corruption issues.
>
> This possible bug was identified using a static analysis tool developed
> by myself, specifically designed to detect RCU-related issues.
>
> To address this, the assignment is now done using rcu_assign_pointer(),
> which ensures that the pointer assignment is done safely, with the
> necessary memory barriers and synchronization. This change prevents
> potential RCU dereference issues by ensuring that the `cat` field is
> safely updated while still adhering to RCU's requirements.
>
> Fixes: 0817534ff9ea ("smackfs: Fix use-after-free in netlbl_catmap_walk()")
> Signed-off-by: Jiawei Ye <jiawei.ye@...mail.com>

Applied to the smack-next tree. Thank you.

> ---
>  security/smack/smackfs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
> index e22aad7604e8..5dd1e164f9b1 100644
> --- a/security/smack/smackfs.c
> +++ b/security/smack/smackfs.c
> @@ -932,7 +932,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
>  	}
>  	if (rc >= 0) {
>  		old_cat = skp->smk_netlabel.attr.mls.cat;
> -		skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
> +		rcu_assign_pointer(skp->smk_netlabel.attr.mls.cat, ncats.attr.mls.cat);
>  		skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
>  		synchronize_rcu();
>  		netlbl_catmap_free(old_cat);