Xiao Liang 290a6b88e8 apparmor: Fix null pointer deref when receiving skb during sock creation ... [ Upstream commit fce09ea314505a52f2436397608fa0a5d0934fb1 ] The panic below is observed when receiving ICMP packets with secmark set while an ICMP raw socket is being created. SK_CTX(sk)->label is updated in apparmor_socket_post_create(), but the packet is delivered to the socket before that, causing the null pointer dereference. Drop the packet if label context is not set. BUG: kernel NULL pointer dereference, address: 000000000000004c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020 RIP: 0010:aa_label_next_confined+0xb/0x40 Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2 RSP: 0018:ffffa92940003b08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002 R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400 R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000 FS: 00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0 PKRU: 55555554 Call Trace: <IRQ> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x7f/0x180 ? asm_exc_page_fault+0x26/0x30 ? aa_label_next_confined+0xb/0x40 apparmor_secmark_check+0xec/0x330 security_sock_rcv_skb+0x35/0x50 sk_filter_trim_cap+0x47/0x250 sock_queue_rcv_skb_reason+0x20/0x60 raw_rcv+0x13c/0x210 raw_local_deliver+0x1f3/0x250 ip_protocol_deliver_rcu+0x4f/0x2f0 ip_local_deliver_finish+0x76/0xa0 __netif_receive_skb_one_core+0x89/0xa0 netif_receive_skb+0x119/0x170 ? __netdev_alloc_skb+0x3d/0x140 vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a] vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a] __napi_poll+0x28/0x1b0 net_rx_action+0x2a4/0x380 __do_softirq+0xd1/0x2c8 __irq_exit_rcu+0xbb/0xf0 common_interrupt+0x86/0xa0 </IRQ> <TASK> asm_common_interrupt+0x26/0x40 RIP: 0010:apparmor_socket_post_create+0xb/0x200 Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48 RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286 RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003 R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748 ? __pfx_apparmor_socket_post_create+0x10/0x10 security_socket_post_create+0x4b/0x80 __sock_create+0x176/0x1f0 __sys_socket+0x89/0x100 __x64_sys_socket+0x17/0x20 do_syscall_64+0x5d/0x90 ? do_syscall_64+0x6c/0x90 ? do_syscall_64+0x6c/0x90 ? do_syscall_64+0x6c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixes: ab9f211508 ("apparmor: Allow filtering based on secmark policy") Signed-off-by: Xiao Liang <shaw.leon@gmail.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-08-19 05:45:25 +02:00
..
include	ima: Avoid blocking in RCU read-side critical section	2024-07-18 13:07:34 +02:00
.gitignore	.gitignore: add SPDX License Identifier	2020-03-25 11:50:48 +01:00
Kconfig	Minor fixes for v5.9.	2020-08-11 14:30:36 -07:00
Makefile	apparmor: add base infastructure for socket mediation	2018-03-13 17:25:48 -07:00
apparmorfs.c	apparmor: fix a memleak in multi_transaction_new()	2022-12-31 13:14:21 +01:00
audit.c	ima: Avoid blocking in RCU read-side critical section	2024-07-18 13:07:34 +02:00
capability.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
crypto.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
domain.c	apparmor: fix overlapping attachment computation	2022-08-25 11:40:00 +02:00
file.c	apparmor: handle idmapped mounts	2021-01-24 14:27:20 +01:00
ipc.c	audit: purge audit_log_string from the intra-kernel audit API	2020-07-21 11:12:31 -04:00
label.c	apparmor: fix aa_label_asxprint return check	2022-08-25 11:40:00 +02:00
lib.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
lsm.c	apparmor: Fix null pointer deref when receiving skb during sock creation	2024-08-19 05:45:25 +02:00
match.c	apparmor: ensure that dfa state tables have entries	2020-04-08 04:42:48 -07:00
mount.c	apparmor: fix reference count leak in aa_pivotroot()	2022-08-25 11:40:01 +02:00
net.c	security: add const qualifier to struct sock in various places	2020-12-03 12:56:03 -08:00
nulldfa.in	apparmor: cleanup add proper line wrapping to nulldfa.in	2018-02-09 11:30:01 -08:00
path.c	AppArmor: Remove semicolon	2020-01-18 15:36:58 -08:00
policy.c	apparmor: use kvfree_sensitive to free data->data	2024-08-19 05:45:13 +02:00
policy_ns.c	apparmor: Fix memleak in alloc_ns()	2022-12-31 13:14:22 +01:00
policy_unpack.c	apparmor: use kvfree_sensitive to free data->data	2024-08-19 05:45:13 +02:00
policy_unpack_test.c	apparmor: add AppArmor KUnit tests for policy unpack	2020-01-09 16:27:43 -07:00
procattr.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
resource.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
secid.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
stacksplitdfa.in	apparmor: use the dfa to do label parse string splitting	2018-02-09 11:30:01 -08:00
task.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00