• Dmitry Kasatkin's avatar
    evm: checking if removexattr is not a NULL · a67adb99
    Dmitry Kasatkin authored
    The following lines of code produce a kernel oops.
    
    fd = socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
    fchmod(fd, 0666);
    
    [  139.922364] BUG: unable to handle kernel NULL pointer dereference at   (null)
    [  139.924982] IP: [<  (null)>]   (null)
    [  139.924982] *pde = 00000000
    [  139.924982] Oops: 0000 [#5] SMP
    [  139.924982] Modules linked in: fuse dm_crypt dm_mod i2c_piix4 serio_raw evdev binfmt_misc button
    [  139.924982] Pid: 3070, comm: acpid Tainted: G      D      3.8.0-rc2-kds+ #465 Bochs Bochs
    [  139.924982] EIP: 0060:[<00000000>] EFLAGS: 00010246 CPU: 0
    [  139.924982] EIP is at 0x0
    [  139.924982] EAX: cf5ef000 EBX: cf5ef000 ECX: c143d600 EDX: c15225f2
    [  139.924982] ESI: cf4d2a1c EDI: cf4d2a1c EBP: cc02df10 ESP: cc02dee4
    [  139.924982]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
    [  139.924982] CR0: 80050033 CR2: 00000000 CR3: 0c059000 CR4: 000006d0
    [  139.924982] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
    [  139.924982] DR6: ffff0ff0 DR7: 00000400
    [  139.924982] Process acpid (pid: 3070, ti=cc02c000 task=d7705340 task.ti=cc02c000)
    [  139.924982] Stack:
    [  139.924982]  c1203c88 00000000 cc02def4 cf4d2a1c ae21eefa 471b60d5 1083c1ba c26a5940
    [  139.924982]  e891fb5e 00000041 00000004 cc02df1c c1203964 00000000 cc02df4c c10e20c3
    [  139.924982]  00000002 00000000 00000000 22222222 c1ff2222 cf5ef000 00000000 d76efb08
    [  139.924982] Call Trace:
    [  139.924982]  [<c1203c88>] ? evm_update_evmxattr+0x5b/0x62
    [  139.924982]  [<c1203964>] evm_inode_post_setattr+0x22/0x26
    [  139.924982]  [<c10e20c3>] notify_change+0x25f/0x281
    [  139.924982]  [<c10cbf56>] chmod_common+0x59/0x76
    [  139.924982]  [<c10e27a1>] ? put_unused_fd+0x33/0x33
    [  139.924982]  [<c10cca09>] sys_fchmod+0x39/0x5c
    [  139.924982]  [<c13f4f30>] syscall_call+0x7/0xb
    [  139.924982] Code:  Bad EIP value.
    
    This happens because sockets do not define the removexattr operation.
    Before removing the xattr, verify the removexattr function pointer is
    not NULL.
    Signed-off-by: default avatarDmitry Kasatkin <dmitry.kasatkin@intel.com>
    Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
    a67adb99
evm_crypto.c 6.2 KB