John Johansen 69af22696b apparmor: fix oops in audit_signal_cb hook ... commit b12cbb2158 upstream. The apparmor_audit_data struct ordering got messed up during a merge conflict, resulting in the signal integer and peer pointer being in a union instead of a struct. For most of the 4.13 and 4.14 life cycle, this was hidden by commit 651e28c553 ("apparmor: add base infastructure for socket mediation") which fixed the apparmor_audit_data struct when its data was added. When that commit was reverted in -rc7 the signal audit bug was exposed, and unfortunately it never showed up in any of the testing until after 4.14 was released. Shaun Khan, Zephaniah E. Loss-Cutler-Hull filed nearly simultaneous bug reports (with different oopes, the smaller of which is included below). Full credit goes to Tetsuo Handa for jumping on this as well and noticing the audit data struct problem and reporting it. [ 76.178568] BUG: unable to handle kernel paging request at ffffffff0eee3bc0 [ 76.178579] IP: audit_signal_cb+0x6c/0xe0 [ 76.178581] PGD 1a640a067 P4D 1a640a067 PUD 0 [ 76.178586] Oops: 0000 [#1] PREEMPT SMP [ 76.178589] Modules linked in: fuse rfcomm bnep usblp uvcvideo btusb btrtl btbcm btintel bluetooth ecdh_generic ip6table_filter ip6_tables xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack iptable_filter ip_tables x_tables intel_rapl joydev wmi_bmof serio_raw iwldvm iwlwifi shpchp kvm_intel kvm irqbypass autofs4 algif_skcipher nls_iso8859_1 nls_cp437 crc32_pclmul ghash_clmulni_intel [ 76.178620] CPU: 0 PID: 10675 Comm: pidgin Not tainted 4.14.0-f1-dirty #135 [ 76.178623] Hardware name: Hewlett-Packard HP EliteBook Folio 9470m/18DF, BIOS 68IBD Ver. F.62 10/22/2015 [ 76.178625] task: ffff9c7a94c31dc0 task.stack: ffffa09b02a4c000 [ 76.178628] RIP: 0010:audit_signal_cb+0x6c/0xe0 [ 76.178631] RSP: 0018:ffffa09b02a4fc08 EFLAGS: 00010292 [ 76.178634] RAX: ffffa09b02a4fd60 RBX: ffff9c7aee0741f8 RCX: 0000000000000000 [ 76.178636] RDX: ffffffffee012290 RSI: 0000000000000006 RDI: ffff9c7a9493d800 [ 76.178638] RBP: ffffa09b02a4fd40 R08: 000000000000004d R09: ffffa09b02a4fc46 [ 76.178641] R10: ffffa09b02a4fcb8 R11: ffff9c7ab44f5072 R12: ffffa09b02a4fd40 [ 76.178643] R13: ffffffff9e447be0 R14: ffff9c7a94c31dc0 R15: 0000000000000001 [ 76.178646] FS: 00007f8b11ba2a80(0000) GS:ffff9c7afea00000(0000) knlGS:0000000000000000 [ 76.178648] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.178650] CR2: ffffffff0eee3bc0 CR3: 00000003d5209002 CR4: 00000000001606f0 [ 76.178652] Call Trace: [ 76.178660] common_lsm_audit+0x1da/0x780 [ 76.178665] ? d_absolute_path+0x60/0x90 [ 76.178669] ? aa_check_perms+0xcd/0xe0 [ 76.178672] aa_check_perms+0xcd/0xe0 [ 76.178675] profile_signal_perm.part.0+0x90/0xa0 [ 76.178679] aa_may_signal+0x16e/0x1b0 [ 76.178686] apparmor_task_kill+0x51/0x120 [ 76.178690] security_task_kill+0x44/0x60 [ 76.178695] group_send_sig_info+0x25/0x60 [ 76.178699] kill_pid_info+0x36/0x60 [ 76.178703] SYSC_kill+0xdb/0x180 [ 76.178707] ? preempt_count_sub+0x92/0xd0 [ 76.178712] ? _raw_write_unlock_irq+0x13/0x30 [ 76.178716] ? task_work_run+0x6a/0x90 [ 76.178720] ? exit_to_usermode_loop+0x80/0xa0 [ 76.178723] entry_SYSCALL_64_fastpath+0x13/0x94 [ 76.178727] RIP: 0033:0x7f8b0e58b767 [ 76.178729] RSP: 002b:00007fff19efd4d8 EFLAGS: 00000206 ORIG_RAX: 000000000000003e [ 76.178732] RAX: ffffffffffffffda RBX: 0000557f3e3c2050 RCX: 00007f8b0e58b767 [ 76.178735] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000263b [ 76.178737] RBP: 0000000000000000 R08: 0000557f3e3c2270 R09: 0000000000000001 [ 76.178739] R10: 000000000000022d R11: 0000000000000206 R12: 0000000000000000 [ 76.178741] R13: 0000000000000001 R14: 0000557f3e3c13c0 R15: 0000000000000000 [ 76.178745] Code: 48 8b 55 18 48 89 df 41 b8 20 00 08 01 5b 5d 48 8b 42 10 48 8b 52 30 48 63 48 4c 48 8b 44 c8 48 31 c9 48 8b 70 38 e9 f4 fd 00 00 <48> 8b 14 d5 40 27 e5 9e 48 c7 c6 7d 07 19 9f 48 89 df e8 fd 35 [ 76.178794] RIP: audit_signal_cb+0x6c/0xe0 RSP: ffffa09b02a4fc08 [ 76.178796] CR2: ffffffff0eee3bc0 [ 76.178799] ---[ end trace 514af9529297f1a3 ]--- Fixes: cd1dbf76b2 ("apparmor: add the ability to mediate signals") Reported-by: Zephaniah E. Loss-Cutler-Hull <warp-spam_kernel@aehallh.com> Reported-by: Shuah Khan <shuahkh@osg.samsung.com> Suggested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> Tested-by: Ivan Kozik <ivan@ludios.org> Tested-by: Zephaniah E. Loss-Cutler-Hull <warp-spam_kernel@aehallh.com> Tested-by: Christian Boltz <apparmor@cboltz.de> Tested-by: Shuah Khan <shuahkh@osg.samsung.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-12-05 11:26:31 +01:00
..
include	apparmor: fix oops in audit_signal_cb hook	2017-12-05 11:26:31 +01:00
.gitignore	Revert "apparmor: add base infastructure for socket mediation"	2017-10-26 19:35:35 +02:00
Kconfig	apparmor: add debug assert AA_BUG and Kconfig to control debug info	2017-01-16 01:18:24 -08:00
Makefile	License cleanup: add SPDX license identifiers to some files	2017-11-02 10:04:46 -07:00
apparmorfs.c	Revert "apparmor: add base infastructure for socket mediation"	2017-10-26 19:35:35 +02:00
audit.c	apparmor: switch from profiles to using labels on contexts	2017-06-10 17:11:38 -07:00
capability.c	apparmor: move capability checks to using labels	2017-06-10 17:11:40 -07:00
context.c	apparmor: switch from profiles to using labels on contexts	2017-06-10 17:11:38 -07:00
crypto.c	apparmor: use SHASH_DESC_ON_STACK	2017-04-07 08:58:35 +10:00
domain.c	+ Features	2017-09-23 05:33:29 -10:00
file.c	Revert "apparmor: add base infastructure for socket mediation"	2017-10-26 19:35:35 +02:00
ipc.c	apparmor: fix off-by-one comparison on MAXMAPPED_SIG	2017-11-08 10:56:22 -08:00
label.c	apparmor: fix incorrect type assignment when freeing proxies	2017-09-22 13:00:58 -07:00
lib.c	Revert "apparmor: add base infastructure for socket mediation"	2017-10-26 19:35:35 +02:00
lsm.c	Revert "apparmor: add base infastructure for socket mediation"	2017-10-26 19:35:35 +02:00
match.c	doc: ReSTify apparmor.txt	2017-05-18 10:32:38 -06:00
mount.c	apparmor: add mount mediation	2017-09-22 13:00:57 -07:00
nulldfa.in	apparmor: add a default null dfa	2017-01-16 01:18:34 -08:00
path.c	apparmor: Move path lookup to using preallocated buffers	2017-06-08 11:29:34 -07:00
policy.c	apparmor: fix race condition in null profile creation	2017-09-22 13:00:58 -07:00
policy_ns.c	apparmor: ensure unconfined profiles have dfas initialized	2017-09-22 13:00:58 -07:00
policy_unpack.c	Revert "apparmor: add base infastructure for socket mediation"	2017-10-26 19:35:35 +02:00
procattr.c	apparmor: switch getprocattr to using label_print fns()	2017-06-10 17:11:39 -07:00
resource.c	apparmor: move resource checks to using labels	2017-06-10 17:11:40 -07:00
secid.c	apparmor: rename sid to secid	2017-01-16 00:42:17 -08:00