Zubin Mithra d0a636aa44 apparmor: Fix uninitialized value in aa_split_fqname ... [ Upstream commit 250f2da49c ] Syzkaller reported a OOB-read with the stacktrace below. This occurs inside __aa_lookupn_ns as `n` is not initialized. `n` is obtained from aa_splitn_fqname. In cases where `name` is invalid, aa_splitn_fqname returns without initializing `ns_name` and `ns_len`. Fix this by always initializing `ns_name` and `ns_len`. __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430 memcmp+0xe3/0x160 lib/string.c:861 strnstr+0x4b/0x70 lib/string.c:934 __aa_lookupn_ns+0xc1/0x570 security/apparmor/policy_ns.c:209 aa_lookupn_ns+0x88/0x1e0 security/apparmor/policy_ns.c:240 aa_fqlookupn_profile+0x1b9/0x1010 security/apparmor/policy.c:468 fqlookupn_profile+0x80/0xc0 security/apparmor/label.c:1844 aa_label_strn_parse+0xa3a/0x1230 security/apparmor/label.c:1908 aa_label_parse+0x42/0x50 security/apparmor/label.c:1943 aa_change_profile+0x513/0x3510 security/apparmor/domain.c:1362 apparmor_setprocattr+0xaa4/0x1150 security/apparmor/lsm.c:658 security_setprocattr+0x66/0xc0 security/security.c:1298 proc_pid_attr_write+0x301/0x540 fs/proc/base.c:2555 __vfs_write+0x119/0x9f0 fs/read_write.c:485 vfs_write+0x1fc/0x560 fs/read_write.c:549 ksys_write+0x101/0x260 fs/read_write.c:598 __do_sys_write fs/read_write.c:610 [inline] __se_sys_write fs/read_write.c:607 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:607 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: 3b0aaf5866 ("apparmor: add lib fn to find the "split" for fqnames") Reported-by: syzbot+61e4b490d9d2da591b50@syzkaller.appspotmail.com Signed-off-by: Zubin Mithra <zsm@chromium.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2018-11-27 16:10:47 +01:00
..
apparmor	apparmor: Fix uninitialized value in aa_split_fqname	2018-11-27 16:10:47 +01:00
integrity	ima: fix showing large 'violations' or 'runtime_measurements_count'	2018-11-13 11:15:08 -08:00
keys	Revert "uapi/linux/keyctl.h: don't use C++ reserved keyword as a struct member name"	2018-09-29 03:06:04 -07:00
loadpin	security: mark LSM hooks as __ro_after_init	2017-03-06 11:00:15 +11:00
selinux	selinux: KASAN: slab-out-of-bounds in xattr_getsecurity	2018-06-05 11:41:56 +02:00
smack	Smack: Fix handling of IPv4 traffic received by PF_INET6 sockets	2018-09-26 08:38:03 +02:00
tomoyo	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
yama	doc: ReSTify Yama.txt	2017-05-18 10:33:04 -06:00
commoncap.c	cap_inode_getsecurity: use d_find_any_alias() instead of d_find_alias()	2018-09-09 19:56:01 +02:00
device_cgroup.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
inode.c	securityfs: add the ability to support symlinks	2017-06-08 12:51:43 -07:00
Kconfig	/dev/mem: Add bounce buffer for copy-out	2018-03-24 11:01:24 +01:00
lsm_audit.c	lsm_audit: update my email address	2017-08-17 15:33:39 -04:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
min_addr.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
security.c	security: check for kstrdup() failure in lsm_append()	2018-09-26 08:38:09 +02:00