{"push_id":836707655,"size":1,"distinct_size":1,"ref":"refs/heads/lp5.1","head":"ba58a0997ccaf18725c80264a9ed278cf1dd7d52","before":"e7b1935af5d1ca0e21a04a02243f864afb17b6d2","commits":[{"sha":"ba58a0997ccaf18725c80264a9ed278cf1dd7d52","author":{"email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org","name":"Steven Rostedt"},"message":"SELinux: Fix possible NULL pointer dereference in selinux_inode_permission()\n\nWhile running stress tests on adding and deleting ftrace instances I hit\nthis bug:\n\n  BUG: unable to handle kernel NULL pointer dereference at 0000000000000020\n  IP: selinux_inode_permission+0x85/0x160\n  PGD 63681067 PUD 7ddbe067 PMD 0\n  Oops: 0000 [#1] PREEMPT\n  CPU: 0 PID: 5634 Comm: ftrace-test-mki Not tainted 3.13.0-rc4-test-00033-gd2a6dde-dirty #20\n  Hardware name:                  /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006\n  task: ffff880078375800 ti: ffff88007ddb0000 task.ti: ffff88007ddb0000\n  RIP: 0010:[<ffffffff812d8bc5>]  [<ffffffff812d8bc5>] selinux_inode_permission+0x85/0x160\n  RSP: 0018:ffff88007ddb1c48  EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: 0000000000800000 RCX: ffff88006dd43840\n  RDX: 0000000000000001 RSI: 0000000000000081 RDI: ffff88006ee46000\n  RBP: ffff88007ddb1c88 R08: 0000000000000000 R09: ffff88007ddb1c54\n  R10: 6e6576652f6f6f66 R11: 0000000000000003 R12: 0000000000000000\n  R13: 0000000000000081 R14: ffff88006ee46000 R15: 0000000000000000\n  FS:  00007f217b5b6700(0000) GS:ffffffff81e21000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033^M\n  CR2: 0000000000000020 CR3: 000000006a0fe000 CR4: 00000000000007f0\n  Call Trace:\n    security_inode_permission+0x1c/0x30\n    __inode_permission+0x41/0xa0\n    inode_permission+0x18/0x50\n    link_path_walk+0x66/0x920\n    path_openat+0xa6/0x6c0\n    do_filp_open+0x43/0xa0\n    do_sys_open+0x146/0x240\n    SyS_open+0x1e/0x20\n    system_call_fastpath+0x16/0x1b\n  Code: 84 a1 00 00 00 81 e3 00 20 00 00 89 d8 83 c8 02 40 f6 c6 04 0f 45 d8 40 f6 c6 08 74 71 80 cf 02 49 8b 46 38 4c 8d 4d cc 45 31 c0 <0f> b7 50 20 8b 70 1c 48 8b 41 70 89 d9 8b 78 04 e8 36 cf ff ff\n  RIP  selinux_inode_permission+0x85/0x160\n  CR2: 0000000000000020\n\nInvestigating, I found that the inode->i_security was NULL, and the\ndereference of it caused the oops.\n\nin selinux_inode_permission():\n\n\tisec = inode->i_security;\n\n\trc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);\n\nNote, the crash came from stressing the deletion and reading of debugfs\nfiles.  I was not able to recreate this via normal files.  But I'm not\nsure they are safe.  It may just be that the race window is much harder\nto hit.\n\nWhat seems to have happened (and what I have traced), is the file is\nbeing opened at the same time the file or directory is being deleted.\nAs the dentry and inode locks are not held during the path walk, nor is\nthe inodes ref counts being incremented, there is nothing saving these\nstructures from being discarded except for an rcu_read_lock().\n\nThe rcu_read_lock() protects against freeing of the inode, but it does\nnot protect freeing of the inode_security_struct.  Now if the freeing of\nthe i_security happens with a call_rcu(), and the i_security field of\nthe inode is not changed (it gets freed as the inode gets freed) then\nthere will be no issue here.  (Linus Torvalds suggested not setting the\nfield to NULL such that we do not need to check if it is NULL in the\npermission check).\n\nNote, this is a hack, but it fixes the problem at hand.  A real fix is\nto restructure the destroy_inode() to call all the destructor handlers\nfrom the RCU callback.  But that is a major job to do, and requires a\nlot of work.  For now, we just band-aid this bug with this fix (it\nworks), and work on a more maintainable solution in the future.\n\nLink: http://lkml.kernel.org/r/20140109101932.0508dec7@gandalf.local.home\nLink: http://lkml.kernel.org/r/20140109182756.17abaaa8@gandalf.local.home\n\nChange-Id: I4d46ef5caa0b561c0e1070959796bd9e72d607bd\nCc: stable@vger.kernel.org\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>","distinct":true,"url":"https://api.github.com/repos/andi34/android_kernel_samsung_golden/commits/ba58a0997ccaf18725c80264a9ed278cf1dd7d52"}]}