Sachin Grover 9808c97d3c selinux: KASAN: slab-out-of-bounds in xattr_getsecurity ... commit efe3de79e0 upstream. Call trace: [<ffffff9203a8d7a8>] dump_backtrace+0x0/0x428 [<ffffff9203a8dbf8>] show_stack+0x28/0x38 [<ffffff920409bfb8>] dump_stack+0xd4/0x124 [<ffffff9203d187e8>] print_address_description+0x68/0x258 [<ffffff9203d18c00>] kasan_report.part.2+0x228/0x2f0 [<ffffff9203d1927c>] kasan_report+0x5c/0x70 [<ffffff9203d1776c>] check_memory_region+0x12c/0x1c0 [<ffffff9203d17cdc>] memcpy+0x34/0x68 [<ffffff9203d75348>] xattr_getsecurity+0xe0/0x160 [<ffffff9203d75490>] vfs_getxattr+0xc8/0x120 [<ffffff9203d75d68>] getxattr+0x100/0x2c8 [<ffffff9203d76fb4>] SyS_fgetxattr+0x64/0xa0 [<ffffff9203a83f70>] el0_svc_naked+0x24/0x28 If user get root access and calls security.selinux setxattr() with an embedded NUL on a file and then if some process performs a getxattr() on that file with a length greater than the actual length of the string, it would result in a panic. To fix this, add the actual length of the string to the security context instead of the length passed by the userspace process. Signed-off-by: Sachin Grover <sgrover@codeaurora.org> Cc: stable@vger.kernel.org Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-06-05 11:41:56 +02:00
..
apparmor	apparmor: fix resource audit messages when auditing peer	2018-04-19 08:56:18 +02:00
integrity	ima: Fallback to the builtin hash algorithm	2018-05-30 07:52:29 +02:00
keys	KEYS: reject NULL restriction string when type is specified	2017-12-14 09:52:53 +01:00
loadpin	…
selinux	selinux: KASAN: slab-out-of-bounds in xattr_getsecurity	2018-06-05 11:41:56 +02:00
smack	lsm: fix smack_inode_removexattr and xattr_getsecurity memleak	2017-10-04 18:03:15 +11:00
tomoyo	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
yama	…
Kconfig	/dev/mem: Add bounce buffer for copy-out	2018-03-24 11:01:24 +01:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
commoncap.c	commoncap: Handle memory allocation failure.	2018-04-29 11:33:16 +02:00
device_cgroup.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
inode.c	…
lsm_audit.c	lsm_audit: update my email address	2017-08-17 15:33:39 -04:00
min_addr.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
security.c	selinux/stable-4.14 PR 20170831	2017-09-12 13:21:00 -07:00