Skip to content
Snippets Groups Projects
  • Huacai Chen's avatar
    35fcac7a
    audit: Initialize lsmctx to avoid memory allocation error · 35fcac7a
    Huacai Chen authored
    
    When audit is enabled in a kernel build, and there are no LSMs active
    that support LSM labeling, it is possible that local variable lsmctx
    in the AUDIT_SIGNAL_INFO handler in audit_receive_msg() could be used
    before it is properly initialize. Then kmalloc() will try to allocate
    a large amount of memory with the uninitialized length.
    
    This patch corrects this problem by initializing the lsmctx to a safe
    value when it is declared, which avoid errors like:
    
     WARNING: CPU: 2 PID: 443 at mm/page_alloc.c:4727 __alloc_pages_noprof
            ...
        ra: 9000000003059644 ___kmalloc_large_node+0x84/0x1e0
       ERA: 900000000304d588 __alloc_pages_noprof+0x4c8/0x1040
      CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
      PRMD: 00000004 (PPLV0 +PIE -PWE)
      EUEN: 00000007 (+FPE +SXE +ASXE -BTE)
      ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)
     ESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0)
      PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)
     CPU: 2 UID: 0 PID: 443 Comm: auditd Not tainted 6.13.0-rc1+ #1899
            ...
     Call Trace:
     [<9000000002def6a8>] show_stack+0x30/0x148
     [<9000000002debf58>] dump_stack_lvl+0x68/0xa0
     [<9000000002e0fe18>] __warn+0x80/0x108
     [<900000000407486c>] report_bug+0x154/0x268
     [<90000000040ad468>] do_bp+0x2a8/0x320
     [<9000000002dedda0>] handle_bp+0x120/0x1c0
     [<900000000304d588>] __alloc_pages_noprof+0x4c8/0x1040
     [<9000000003059640>] ___kmalloc_large_node+0x80/0x1e0
     [<9000000003061504>] __kmalloc_noprof+0x2c4/0x380
     [<9000000002f0f7ac>] audit_receive_msg+0x764/0x1530
     [<9000000002f1065c>] audit_receive+0xe4/0x1c0
     [<9000000003e5abe8>] netlink_unicast+0x340/0x450
     [<9000000003e5ae9c>] netlink_sendmsg+0x1a4/0x4a0
     [<9000000003d9ffd0>] __sock_sendmsg+0x48/0x58
     [<9000000003da32f0>] __sys_sendto+0x100/0x170
     [<9000000003da3374>] sys_sendto+0x14/0x28
     [<90000000040ad574>] do_syscall+0x94/0x138
     [<9000000002ded318>] handle_syscall+0xb8/0x158
    
    Fixes: 6fba8981 ("lsm: ensure the correct LSM context releaser")
    Signed-off-by: default avatarHuacai Chen <chenhuacai@loongson.cn>
    [PM: resolved excessive line length in the backtrace]
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    35fcac7a
    History
    audit: Initialize lsmctx to avoid memory allocation error
    Huacai Chen authored
    
    When audit is enabled in a kernel build, and there are no LSMs active
    that support LSM labeling, it is possible that local variable lsmctx
    in the AUDIT_SIGNAL_INFO handler in audit_receive_msg() could be used
    before it is properly initialize. Then kmalloc() will try to allocate
    a large amount of memory with the uninitialized length.
    
    This patch corrects this problem by initializing the lsmctx to a safe
    value when it is declared, which avoid errors like:
    
     WARNING: CPU: 2 PID: 443 at mm/page_alloc.c:4727 __alloc_pages_noprof
            ...
        ra: 9000000003059644 ___kmalloc_large_node+0x84/0x1e0
       ERA: 900000000304d588 __alloc_pages_noprof+0x4c8/0x1040
      CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
      PRMD: 00000004 (PPLV0 +PIE -PWE)
      EUEN: 00000007 (+FPE +SXE +ASXE -BTE)
      ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)
     ESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0)
      PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)
     CPU: 2 UID: 0 PID: 443 Comm: auditd Not tainted 6.13.0-rc1+ #1899
            ...
     Call Trace:
     [<9000000002def6a8>] show_stack+0x30/0x148
     [<9000000002debf58>] dump_stack_lvl+0x68/0xa0
     [<9000000002e0fe18>] __warn+0x80/0x108
     [<900000000407486c>] report_bug+0x154/0x268
     [<90000000040ad468>] do_bp+0x2a8/0x320
     [<9000000002dedda0>] handle_bp+0x120/0x1c0
     [<900000000304d588>] __alloc_pages_noprof+0x4c8/0x1040
     [<9000000003059640>] ___kmalloc_large_node+0x80/0x1e0
     [<9000000003061504>] __kmalloc_noprof+0x2c4/0x380
     [<9000000002f0f7ac>] audit_receive_msg+0x764/0x1530
     [<9000000002f1065c>] audit_receive+0xe4/0x1c0
     [<9000000003e5abe8>] netlink_unicast+0x340/0x450
     [<9000000003e5ae9c>] netlink_sendmsg+0x1a4/0x4a0
     [<9000000003d9ffd0>] __sock_sendmsg+0x48/0x58
     [<9000000003da32f0>] __sys_sendto+0x100/0x170
     [<9000000003da3374>] sys_sendto+0x14/0x28
     [<90000000040ad574>] do_syscall+0x94/0x138
     [<9000000002ded318>] handle_syscall+0xb8/0x158
    
    Fixes: 6fba8981 ("lsm: ensure the correct LSM context releaser")
    Signed-off-by: default avatarHuacai Chen <chenhuacai@loongson.cn>
    [PM: resolved excessive line length in the backtrace]
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>