Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Georgia Garcia 6d8c180c82 apparmor: fix invalid deref of rawdata when export_binary is unset ... [ Upstream commit df9ac55abd ] If the export_binary parameter is disabled on runtime, profiles that were loaded before that will still have their rawdata stored in apparmorfs, with a symbolic link to the rawdata on the policy directory. When one of those profiles are replaced, the rawdata is set to NULL, but when trying to resolve the symbolic links to rawdata for that profile, it will try to dereference profile->rawdata->name when profile->rawdata is now NULL causing an oops. Fix it by checking if rawdata is set. [ 168.653080] BUG: kernel NULL pointer dereference, address: 0000000000000088 [ 168.657420] #PF: supervisor read access in kernel mode [ 168.660619] #PF: error_code(0x0000) - not-present page [ 168.663613] PGD 0 P4D 0 [ 168.665450] Oops: Oops: 0000 [#1] SMP NOPTI [ 168.667836] CPU: 1 UID: 0 PID: 1729 Comm: ls Not tainted 6.19.0-rc7+ #3 PREEMPT(voluntary) [ 168.672308] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 168.679327] RIP: 0010:rawdata_get_link_base.isra.0+0x23/0x330 [ 168.682768] Code: 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 89 55 d0 48 85 ff 0f 84 e3 01 00 00 <48> 83 3c 25 88 00 00 00 00 0f 84 d4 01 00 00 49 89 f6 49 89 cc e8 [ 168.689818] RSP: 0018:ffffcdcb8200fb80 EFLAGS: 00010282 [ 168.690871] RAX: ffffffffaee74ec0 RBX: 0000000000000000 RCX: ffffffffb0120158 [ 168.692251] RDX: ffffcdcb8200fbe0 RSI: ffff88c187c9fa80 RDI: ffff88c186c98a80 [ 168.693593] RBP: ffffcdcb8200fbc0 R08: 0000000000000000 R09: 0000000000000000 [ 168.694941] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88c186c98a80 [ 168.696289] R13: 00007fff005aaa20 R14: 0000000000000080 R15: ffff88c188f4fce0 [ 168.697637] FS: 0000790e81c58280(0000) GS:ffff88c20a957000(0000) knlGS:0000000000000000 [ 168.699227] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 168.700349] CR2: 0000000000000088 CR3: 000000012fd3e000 CR4: 0000000000350ef0 [ 168.701696] Call Trace: [ 168.702325] <TASK> [ 168.702995] rawdata_get_link_data+0x1c/0x30 [ 168.704145] vfs_readlink+0xd4/0x160 [ 168.705152] do_readlinkat+0x114/0x180 [ 168.706214] __x64_sys_readlink+0x1e/0x30 [ 168.708653] x64_sys_call+0x1d77/0x26b0 [ 168.709525] do_syscall_64+0x81/0x500 [ 168.710348] ? do_statx+0x72/0xb0 [ 168.711109] ? putname+0x3e/0x80 [ 168.711845] ? __x64_sys_statx+0xb7/0x100 [ 168.712711] ? x64_sys_call+0x10fc/0x26b0 [ 168.713577] ? do_syscall_64+0xbf/0x500 [ 168.714412] ? do_user_addr_fault+0x1d2/0x8d0 [ 168.715404] ? irqentry_exit+0xb2/0x740 [ 168.716359] ? exc_page_fault+0x90/0x1b0 [ 168.717307] entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: 1180b4c757 ("apparmor: fix dangling symlinks to policy rawdata after replacement") Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		History 2026-03-04 07:19:53 -05:00
..
include	apparmor: ensure WB_HISTORY_SIZE value is a power of 2	2025-08-28 16:24:11 +02:00
.gitignore	.gitignore: add SPDX License Identifier	2020-03-25 11:50:48 +01:00
apparmorfs.c	apparmor: fix invalid deref of rawdata when export_binary is unset	2026-03-04 07:19:53 -05:00
audit.c	ima: Avoid blocking in RCU read-side critical section	2024-07-18 13:07:34 +02:00
capability.c	apparmor: fix 'Do simple duplicate message elimination'	2024-12-14 19:51:11 +01:00
crypto.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
domain.c	apparmor: fix overlapping attachment computation	2022-08-25 11:40:00 +02:00
file.c	apparmor: handle idmapped mounts	2021-01-24 14:27:20 +01:00
ipc.c	audit: purge audit_log_string from the intra-kernel audit API	2020-07-21 11:12:31 -04:00
Kconfig	Minor fixes for v5.9.	2020-08-11 14:30:36 -07:00
label.c	apparmor: fix aa_label_asxprint return check	2022-08-25 11:40:00 +02:00
lib.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
lsm.c	apparmor: Fix null pointer deref when receiving skb during sock creation	2024-08-19 05:45:25 +02:00
Makefile	apparmor: add base infastructure for socket mediation	2018-03-13 17:25:48 -07:00
match.c	apparmor: ensure WB_HISTORY_SIZE value is a power of 2	2025-08-28 16:24:11 +02:00
mount.c	apparmor: fix reference count leak in aa_pivotroot()	2022-08-25 11:40:01 +02:00
net.c	apparmor: fix NULL sock in aa_sock_file_perm	2026-03-04 07:19:53 -05:00
nulldfa.in	apparmor: cleanup add proper line wrapping to nulldfa.in	2018-02-09 11:30:01 -08:00
path.c	AppArmor: Remove semicolon	2020-01-18 15:36:58 -08:00
policy.c	apparmor: use kvfree_sensitive to free data->data	2024-08-19 05:45:13 +02:00
policy_ns.c	apparmor: Fix memleak in alloc_ns()	2022-12-31 13:14:22 +01:00
policy_unpack.c	apparmor: use kvfree_sensitive to free data->data	2024-08-19 05:45:13 +02:00
policy_unpack_test.c	apparmor: test: Fix memory leak for aa_unpack_strdup()	2024-12-14 19:51:14 +01:00
procattr.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
resource.c	apparmor: fix rlimit for posix cpu timers	2026-03-04 07:19:53 -05:00
secid.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
stacksplitdfa.in	apparmor: use the dfa to do label parse string splitting	2018-02-09 11:30:01 -08:00
task.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00