linux-kernel - Re: [PATCH v2] auditsc: Implement a workaround for a GCC bug triggered by task comm changes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0539f2c64df66fe4adab6ba9a1030ab1@paul-moore.com>
Date: Wed, 04 Dec 2024 22:57:45 -0500
From: Paul Moore <paul@...l-moore.com>
To: Yafang Shao <laoar.shao@...il.com>, keescook@...omium.org
Cc: qiuxu.zhuo@...el.com, rostedt@...dmis.org, lkp@...el.com, audit@...r.kernel.org, linux-kernel@...r.kernel.org, Yafang shao <laoar.shao@...il.com>, Kees Cook <kees@...nel.org>
Subject: Re: [PATCH v2] auditsc: Implement a workaround for a GCC bug triggered  by task comm changes

On Dec  4, 2024 Yafang Shao <laoar.shao@...il.com> wrote:
> 
> A build failure has been reported with the following details:
> 
>    In file included from include/linux/string.h:390,
>                     from include/linux/bitmap.h:13,
>                     from include/linux/cpumask.h:12,
>                     from include/linux/smp.h:13,
>                     from include/linux/lockdep.h:14,
>                     from include/linux/spinlock.h:63,
>                     from include/linux/wait.h:9,
>                     from include/linux/wait_bit.h:8,
>                     from include/linux/fs.h:6,
>                     from kernel/auditsc.c:37:
>    In function 'sized_strscpy',
>        inlined from '__audit_ptrace' at kernel/auditsc.c:2732:2:
> >> include/linux/fortify-string.h:293:17: error: call to '__write_overflow' declared with attribute error: detected write beyond size of object (1st parameter)
>      293 |                 __write_overflow();
>          |                 ^~~~~~~~~~~~~~~~~~
>    In function 'sized_strscpy',
>        inlined from 'audit_signal_info_syscall' at kernel/auditsc.c:2759:3:
> >> include/linux/fortify-string.h:293:17: error: call to '__write_overflow' declared with attribute error: detected write beyond size of object (1st parameter)
>      293 |                 __write_overflow();
>          |                 ^~~~~~~~~~~~~~~~~~
> 
> The issue appears to be a GCC bug, though the root cause remains
> unclear at this time. For now, let's implement a workaround.
> 
> A bug report has also been filed with GCC [0].
> 
> Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117912 [0]
> 
> Reported-by: kernel test robot <lkp@...el.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202410171420.1V00ICVG-lkp@intel.com/
> Reported-by: Steven Rostedt (Google) <rostedt@...dmis.org>
> Closes: https://lore.kernel.org/all/20241128182435.57a1ea6f@gandalf.local.home/
> Reported-by: Zhuo, Qiuxu <qiuxu.zhuo@...el.com>
> Closes: https://lore.kernel.org/all/CY8PR11MB71348E568DBDA576F17DAFF389362@CY8PR11MB7134.namprd11.prod.outlook.com/
> Originally-by: Kees Cook <kees@...nel.org>
> Link: https://lore.kernel.org/linux-hardening/202410171059.C2C395030@keescook/
> Signed-off-by: Yafang shao <laoar.shao@...il.com>
> Tested-by: Steven Rostedt (Google) <rostedt@...dmis.org>
> Tested-by: Yafang Shao <laoar.shao@...il.com>
> ---
>  kernel/auditsc.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> v1->2: Add the link of the GCC bug report

Thanks, it looks like the GCC devs have been able to reproduce the
problem, hopefully we'll have a proper fix soon.  Regardless, we need
to resolve this in the kernel *now* so I'm going to merge this into the
audit/stable-6.12 branch and I'll send it up to Linus after it clears
testing.

> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 279ba5c420a4..561d96affe9f 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2728,8 +2728,8 @@ void __audit_ptrace(struct task_struct *t)
>  	context->target_auid = audit_get_loginuid(t);
>  	context->target_uid = task_uid(t);
>  	context->target_sessionid = audit_get_sessionid(t);
> -	security_task_getlsmprop_obj(t, &context->target_ref);
>  	strscpy(context->target_comm, t->comm);
> +	security_task_getlsmprop_obj(t, &context->target_ref);
>  }
>  
>  /**
> @@ -2755,8 +2755,8 @@ int audit_signal_info_syscall(struct task_struct *t)
>  		ctx->target_auid = audit_get_loginuid(t);
>  		ctx->target_uid = t_uid;
>  		ctx->target_sessionid = audit_get_sessionid(t);
> -		security_task_getlsmprop_obj(t, &ctx->target_ref);
>  		strscpy(ctx->target_comm, t->comm);
> +		security_task_getlsmprop_obj(t, &ctx->target_ref);
>  		return 0;
>  	}
>  
> -- 
> 2.43.5

--
paul-moore.com