Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Georgia Garcia 6d8c180c82 apparmor: fix invalid deref of rawdata when export_binary is unset ... [ Upstream commit df9ac55abd ] If the export_binary parameter is disabled on runtime, profiles that were loaded before that will still have their rawdata stored in apparmorfs, with a symbolic link to the rawdata on the policy directory. When one of those profiles are replaced, the rawdata is set to NULL, but when trying to resolve the symbolic links to rawdata for that profile, it will try to dereference profile->rawdata->name when profile->rawdata is now NULL causing an oops. Fix it by checking if rawdata is set. [ 168.653080] BUG: kernel NULL pointer dereference, address: 0000000000000088 [ 168.657420] #PF: supervisor read access in kernel mode [ 168.660619] #PF: error_code(0x0000) - not-present page [ 168.663613] PGD 0 P4D 0 [ 168.665450] Oops: Oops: 0000 [#1] SMP NOPTI [ 168.667836] CPU: 1 UID: 0 PID: 1729 Comm: ls Not tainted 6.19.0-rc7+ #3 PREEMPT(voluntary) [ 168.672308] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 168.679327] RIP: 0010:rawdata_get_link_base.isra.0+0x23/0x330 [ 168.682768] Code: 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 89 55 d0 48 85 ff 0f 84 e3 01 00 00 <48> 83 3c 25 88 00 00 00 00 0f 84 d4 01 00 00 49 89 f6 49 89 cc e8 [ 168.689818] RSP: 0018:ffffcdcb8200fb80 EFLAGS: 00010282 [ 168.690871] RAX: ffffffffaee74ec0 RBX: 0000000000000000 RCX: ffffffffb0120158 [ 168.692251] RDX: ffffcdcb8200fbe0 RSI: ffff88c187c9fa80 RDI: ffff88c186c98a80 [ 168.693593] RBP: ffffcdcb8200fbc0 R08: 0000000000000000 R09: 0000000000000000 [ 168.694941] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88c186c98a80 [ 168.696289] R13: 00007fff005aaa20 R14: 0000000000000080 R15: ffff88c188f4fce0 [ 168.697637] FS: 0000790e81c58280(0000) GS:ffff88c20a957000(0000) knlGS:0000000000000000 [ 168.699227] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 168.700349] CR2: 0000000000000088 CR3: 000000012fd3e000 CR4: 0000000000350ef0 [ 168.701696] Call Trace: [ 168.702325] <TASK> [ 168.702995] rawdata_get_link_data+0x1c/0x30 [ 168.704145] vfs_readlink+0xd4/0x160 [ 168.705152] do_readlinkat+0x114/0x180 [ 168.706214] __x64_sys_readlink+0x1e/0x30 [ 168.708653] x64_sys_call+0x1d77/0x26b0 [ 168.709525] do_syscall_64+0x81/0x500 [ 168.710348] ? do_statx+0x72/0xb0 [ 168.711109] ? putname+0x3e/0x80 [ 168.711845] ? __x64_sys_statx+0xb7/0x100 [ 168.712711] ? x64_sys_call+0x10fc/0x26b0 [ 168.713577] ? do_syscall_64+0xbf/0x500 [ 168.714412] ? do_user_addr_fault+0x1d2/0x8d0 [ 168.715404] ? irqentry_exit+0xb2/0x740 [ 168.716359] ? exc_page_fault+0x90/0x1b0 [ 168.717307] entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: 1180b4c757 ("apparmor: fix dangling symlinks to policy rawdata after replacement") Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		History 2026-03-04 07:19:53 -05:00
..
apparmor	apparmor: fix invalid deref of rawdata when export_binary is unset	2026-03-04 07:19:53 -05:00
bpf	bpf: lsm: Set bpf_lsm_blob_sizes.lbs_task to 0	2024-10-17 15:11:18 +02:00
integrity	ima: Handle error code returned by ima_filter_rule_match()	2026-01-19 13:09:31 +01:00
keys	KEYS: trusted: Fix a memory leak in tpm2_load_cmd	2026-01-19 13:09:48 +01:00
landlock	landlock: Add the errata interface	2025-05-02 07:44:20 +02:00
loadpin	LoadPin: Ignore the "contents" argument of the LSM hooks	2022-12-31 13:14:45 +01:00
lockdown	Merge branch 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2020-06-02 17:36:24 -07:00
safesetid	safesetid: check size of policy writes	2025-03-13 12:50:17 +01:00
selinux	selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len	2025-06-27 11:05:34 +01:00
smack	smack: /smack/doi: accept previously used values	2026-03-04 07:19:31 -05:00
tomoyo	tomoyo: don't emit warning in tomoyo_write_control()	2025-03-13 12:50:18 +01:00
yama	task_work: cleanup notification modes	2020-10-17 15:05:30 -06:00
commoncap.c	capabilities: fix potential memleak on error path from vfs_getxattr_alloc()	2022-11-10 18:15:39 +01:00
device_cgroup.c	device_cgroup: Roll back to original exceptions after copy failure	2023-01-12 11:58:59 +01:00
inode.c	securityfs: don't pin dentries twice, once is enough...	2025-08-28 16:24:17 +02:00
Kconfig	proc: add config & param to block forcing mem writes	2024-10-17 15:11:27 +02:00
Kconfig.hardening	security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6	2022-12-31 13:14:46 +01:00
lsm_audit.c	audit: remove unnecessary 'ret' initialization	2021-06-11 13:21:28 -04:00
Makefile	security: remove unneeded subdir-$(CONFIG_...)	2021-09-03 08:17:20 +09:00
min_addr.c	sysctl: pass kernel pointers to ->proc_handler	2020-04-27 02:07:40 -04:00
security.c	ima: Avoid blocking in RCU read-side critical section	2024-07-18 13:07:34 +02:00