LSM: general protection fault in legacy_parse_param (ddcdda88) · Commits · e / devices / android_kernel_fairphone_FP5

[ Upstream commit ecff30575b5ad0eda149aadad247b7f75411fd47 ] The usual LSM hook "bail on fail" scheme doesn't work for cases where a security module may return an error code indicating that it does not recognize an input. In this particular case Smack sees a mount option that it recognizes, and returns 0. A call to a BPF hook follows, which returns -ENOPARAM, which confuses the caller because Smack has processed its data. The SELinux hook incorrectly returns 1 on success. There was a time when this was correct, however the current expectation is that it return 0 on success. This is repaired. Reported-by:

<syzbot+d1e3b1d92d25abf97943@syzkaller.appspotmail.com> Signed-off-by:

Casey Schaufler <casey@schaufler-ca.com> Acked-by:

James Morris <jamorris@linux.microsoft.com> Signed-off-by:

Paul Moore <paul@paul-moore.com> Signed-off-by:

Sasha Levin <sashal@kernel.org>

security/security.c

+15 −2

Original line number	Diff line number	Diff line
		@@ -802,9 +802,22 @@ int security_fs_context_dup(struct fs_context fc, struct fs_context src_fc)
		return call_int_hook(fs_context_dup, 0, fc, src_fc);
		}

		int security_fs_context_parse_param(struct fs_context fc, struct fs_parameter param)
		int security_fs_context_parse_param(struct fs_context *fc,
		struct fs_parameter *param)
		{
		return call_int_hook(fs_context_parse_param, -ENOPARAM, fc, param);
		struct security_hook_list *hp;
		int trc;
		int rc = -ENOPARAM;

		hlist_for_each_entry(hp, &security_hook_heads.fs_context_parse_param,
		list) {
		trc = hp->hook.fs_context_parse_param(fc, param);
		if (trc == 0)
		rc = 0;
		else if (trc != -ENOPARAM)
		return trc;
		}
		return rc;
		}

		int security_sb_alloc(struct super_block *sb)

security/selinux/hooks.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -2855,10 +2855,9 @@ static int selinux_fs_context_parse_param(struct fs_context *fc,
		return opt;

		rc = selinux_add_opt(opt, param->string, &fc->security);
		if (!rc) {
		if (!rc)
		param->string = NULL;
		rc = 1;
		}

		return rc;
		}