1. 21 Mar, 2022 1 commit
    • Wang Yufen's avatar
      netlabel: fix out-of-bounds memory accesses · f22881de
      Wang Yufen authored
      In calipso_map_cat_ntoh(), in the for loop, if the return value of
      netlbl_bitmap_walk() is equal to (net_clen_bits - 1), when
      netlbl_bitmap_walk() is called next time, out-of-bounds memory accesses
      of bitmap[byte_offset] occurs.
      
      The bug was found during fuzzing. The following is the fuzzing report
       BUG: KASAN: slab-out-of-bounds in netlbl_bitmap_walk+0x3c/0xd0
       Read of size 1 at addr ffffff8107bf6f70 by task err_OH/252
      
       CPU: 7 PID: 252 Comm: err_OH Not tainted 5.17.0-rc7+ #17
       Hardware name: linux,dummy-virt (DT)
       Call trace:
        dump_backtrace+0x21c/0x230
        show_stack+0x1c/0x60
        dump_stack_lvl+0x64/0x7c
        print_address_description.constprop.0+0x70/0x2d0
        __kasan_report+0x158/0x16c
        kasan_report+0x74/0x120
        __asan_load1+0x80/0xa0
        netlbl_bitmap_walk+0x3c/0xd0
        calipso_opt_getattr+0x1a8/0x230
        calipso_sock_getattr+0x218/0x340
        calipso_sock_getattr+0x44/0x60
        netlbl_sock_getattr+0x44/0x80
        selinux_netlbl_socket_setsockopt+0x138/0x170
        selinux_socket_setsockopt+0x4c/0x60
        security_socket_setsockopt+0x4c/0x90
        __sys_setsockopt+0xbc/0x2b0
        __arm64_sys_setsockopt+0x6c/0x84
        invoke_syscall+0x64/0x190
        el0_svc_common.constprop.0+0x88/0x200
        do_el0_svc+0x88/0xa0
        el0_svc+0x128/0x1b0
        el0t_64_sync_handler+0x9c/0x120
        el0t_64_sync+0x16c/0x170
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarWang Yufen <wangyufen@huawei.com>
      Acked-by: default avatarPaul Moore <paul@paul-moore.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f22881de
  2. 19 Mar, 2022 6 commits
  3. 18 Mar, 2022 33 commits