[5.4,050/111] integrity: double check iint_cache was initialized

From: Mimi Zohar <zohar@linux.ibm.com>

From: Mimi Zohar <zohar@linux.ibm.com>

commit 92063f3ca73aab794bd5408d3361fd5b5ea33079 upstream.

The kernel may be built with multiple LSMs, but only a subset may be
enabled on the boot command line by specifying "lsm=".  Not including
"integrity" on the ordered LSM list may result in a NULL deref.

As reported by Dmitry Vyukov:
in qemu:
qemu-system-x86_64       -enable-kvm     -machine q35,nvdimm -cpu
max,migratable=off -smp 4       -m 4G,slots=4,maxmem=16G        -hda
wheezy.img      -kernel arch/x86/boot/bzImage   -nographic -vga std
 -soundhw all     -usb -usbdevice tablet  -bt hci -bt device:keyboard
   -net user,host=10.0.2.10,hostfwd=tcp::10022-:22 -net
nic,model=virtio-net-pci   -object
memory-backend-file,id=pmem1,share=off,mem-path=/dev/zero,size=64M
  -device nvdimm,id=nvdimm1,memdev=pmem1  -append "console=ttyS0
root=/dev/sda earlyprintk=serial rodata=n oops=panic panic_on_warn=1
panic=86400 lsm=smack numa=fake=2 nopcid dummy_hcd.num=8"   -pidfile
vm_pid -m 2G -cpu host

But it crashes on NULL deref in integrity_inode_get during boot:

Run /sbin/init as init process
BUG: kernel NULL pointer dereference, address: 000000000000001c
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc2+ #97
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.13.0-44-g88ab0c15525c-prebuilt.qemu.org 04/01/2014
RIP: 0010:kmem_cache_alloc+0x2b/0x370 mm/slub.c:2920
Code: 57 41 56 41 55 41 54 41 89 f4 55 48 89 fd 53 48 83 ec 10 44 8b
3d d9 1f 90 0b 65 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 <8b> 5f
1c 4cf
RSP: 0000:ffffc9000032f9d8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888017fc4f00 RCX: 0000000000000000
RDX: ffff888040220000 RSI: 0000000000000c40 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffff888019263627
R10: ffffffff83937cd1 R11: 0000000000000000 R12: 0000000000000c40
R13: ffff888019263538 R14: 0000000000000000 R15: 0000000000ffffff
FS:  0000000000000000(0000) GS:ffff88802d180000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000001c CR3: 000000000b48e000 CR4: 0000000000750ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 integrity_inode_get+0x47/0x260 security/integrity/iint.c:105
 process_measurement+0x33d/0x17e0 security/integrity/ima/ima_main.c:237
 ima_bprm_check+0xde/0x210 security/integrity/ima/ima_main.c:474
 security_bprm_check+0x7d/0xa0 security/security.c:845
 search_binary_handler fs/exec.c:1708 [inline]
 exec_binprm fs/exec.c:1761 [inline]
 bprm_execve fs/exec.c:1830 [inline]
 bprm_execve+0x764/0x19a0 fs/exec.c:1792
 kernel_execve+0x370/0x460 fs/exec.c:1973
 try_to_run_init_process+0x14/0x4e init/main.c:1366
 kernel_init+0x11d/0x1b8 init/main.c:1477
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Modules linked in:
CR2: 000000000000001c
---[ end trace 22d601a500de7d79 ]---

Since LSMs and IMA may be configured at build time, but not enabled at
run time, panic the system if "integrity" was not initialized before use.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Fixes: 79f7865d844c ("LSM: Introduce "lsm=" for boottime LSM selection")
Cc: stable@vger.kernel.org
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/integrity/iint.c |    8 ++++++++
 1 file changed, 8 insertions(+)

Message ID	20210329075616.855850206@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Dmitry Vyukov <dvyukov@google.com>, Mimi Zohar <zohar@linux.ibm.com> Subject: [PATCH 5.4 050/111] integrity: double check iint_cache was initialized Date: Mon, 29 Mar 2021 09:57:58 +0200 Message-Id: <20210329075616.855850206@linuxfoundation.org> In-Reply-To: <20210329075615.186199980@linuxfoundation.org> References: <20210329075615.186199980@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.4,002/111] net: fec: ptp: avoid register access when ipg clock is disabled [5.4,003/111] powerpc/4xx: Fix build errors from mfdcr() [5.4,004/111] atm: eni: dont release is never initialized [5.4,005/111] atm: lanai: dont run lanai_dev_close if not open [5.4,006/111] Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" [5.4,007/111] ALSA: hda: ignore invalid NHLT table [5.4,008/111] ixgbe: Fix memleak in ixgbe_configure_clsu32 [5.4,009/111] net: tehuti: fix error return code in bdx_probe() [5.4,010/111] net: intel: iavf: fix error return code of iavf_init_get_resources() [5.4,011/111] sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count [5.4,012/111] gianfar: fix jumbo packets+napi+rx overrun crash [5.4,013/111] cifs: ask for more credit on async read/write code paths [5.4,014/111] cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev [5.4,015/111] gpiolib: acpi: Add missing IRQF_ONESHOT [5.4,016/111] nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default [5.4,017/111] NFS: Correct size calculation for create reply length [5.4,018/111] net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch() [5.4,019/111] net: wan: fix error return code of uhdlc_init() [5.4,020/111] net: davicom: Use platform_get_irq_optional() [5.4,021/111] atm: uPD98402: fix incorrect allocation [5.4,022/111] atm: idt77252: fix null-ptr-dereference [5.4,023/111] cifs: change noisy error message to FYI [5.4,024/111] irqchip/ingenic: Add support for the JZ4760 [5.4,025/111] sparc64: Fix opcode filtering in handling of no fault loads [5.4,026/111] habanalabs: Call put_pid() when releasing control device [5.4,027/111] u64_stats,lockdep: Fix u64_stats_init() vs lockdep [5.4,028/111] regulator: qcom-rpmh: Correct the pmic5_hfsmps515 buck [5.4,029/111] drm/amd/display: Revert dram_clock_change_latency for DCN2.1 [5.4,030/111] drm/amdgpu: fb BO should be ttm_bo_type_device [5.4,031/111] drm/radeon: fix AGP dependency [5.4,032/111] nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request() [5.4,033/111] nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted [5.4,034/111] nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a [5.4,035/111] nfs: we dont support removing system.nfs4_acl [5.4,036/111] block: Suppress uevent for hidden device when removed [5.4,037/111] ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls [5.4,038/111] ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign [5.4,039/111] netsec: restore phy power state after controller reset [5.4,040/111] platform/x86: intel-vbtn: Stop reporting SW_DOCK events [5.4,041/111] squashfs: fix inode lookup sanity checks [5.4,042/111] squashfs: fix xattr id and id lookup sanity checks [5.4,043/111] kasan: fix per-page tags for non-page_alloc pages [5.4,044/111] gcov: fix clang-11+ support [5.4,045/111] ACPI: video: Add missing callback back for Sony VPCEH3U1E [5.4,046/111] arm64: dts: ls1046a: mark crypto engine dma coherent [5.4,047/111] arm64: dts: ls1012a: mark crypto engine dma coherent [5.4,048/111] arm64: dts: ls1043a: mark crypto engine dma coherent [5.4,049/111] ARM: dts: at91-sama5d27_som1: fix phy address to 7 [5.4,050/111] integrity: double check iint_cache was initialized [5.4,051/111] dm verity: fix DM_VERITY_OPTS_MAX value [5.4,052/111] dm ioctl: fix out of bounds array access when no devices [5.4,053/111] bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD [5.4,054/111] veth: Store queue_mapping independently of XDP prog presence [5.4,055/111] libbpf: Fix INSTALL flag order [5.4,056/111] net/mlx5e: Dont match on Geneve options in case option masks are all zero [5.4,057/111] ipv6: fix suspecious RCU usage warning [5.4,058/111] macvlan: macvlan_count_rx() needs to be aware of preemption [5.4,059/111] net: sched: validate stab values [5.4,060/111] net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port [5.4,061/111] igc: Fix Pause Frame Advertising [5.4,062/111] igc: Fix Supported Pause Frame Link Setting [5.4,063/111] e1000e: add rtnl_lock() to e1000_reset_task [5.4,064/111] e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 [5.4,065/111] net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template [5.4,066/111] ftgmac100: Restart MAC HW once [5.4,067/111] selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed [5.4,068/111] netfilter: ctnetlink: fix dump of the expect mask attribute [5.4,069/111] tcp: relookup sock for RST+ACK packets handled by obsolete req sock [5.4,070/111] can: peak_usb: add forgotten supported devices [5.4,071/111] can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate [5.4,072/111] can: kvaser_pciefd: Always disable bus load reporting [5.4,073/111] can: c_can_pci: c_can_pci_remove(): fix use-after-free [5.4,074/111] can: c_can: move runtime PM enable/disable to c_can_platform [5.4,075/111] can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning [5.4,076/111] can: m_can: m_can_rx_peripheral(): fix RX being blocked by errors [5.4,077/111] mac80211: fix rate mask reset [5.4,078/111] nfp: flower: fix pre_tun mask id allocation [5.4,079/111] libbpf: Use SOCK_CLOEXEC when opening the netlink socket [5.4,080/111] octeontx2-af: Fix irq free in rvu teardown [5.4,081/111] octeontx2-af: fix infinite loop in unmapping NPC counter [5.4,082/111] net: cdc-phonet: fix data-interface release on probe failure [5.4,083/111] r8152: limit the RX buffer size of RTL8153A for USB 2.0 [5.4,084/111] net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes [5.4,085/111] selftests: forwarding: vxlan_bridge_1d: Fix vxlan ecn decapsulate value [5.4,086/111] libbpf: Fix BTF dump of pointer-to-array-of-struct [5.4,087/111] drm/msm: fix shutdown hook in case GPU components failed to bind [5.4,088/111] arm64: kdump: update ppos when reading elfcorehdr [5.4,089/111] PM: runtime: Defer suspending suppliers [5.4,090/111] net/mlx5e: Fix error path for ethtool set-priv-flag [5.4,091/111] PM: EM: postpone creating the debugfs dir till fs_initcall [5.4,092/111] RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server [5.4,093/111] bpf: Dont do bpf_cgroup_storage_set() for kuprobe/tp programs [5.4,094/111] Revert "netfilter: x_tables: Switch synchronization to RCU" [5.4,095/111] netfilter: x_tables: Use correct memory barriers. [5.4,096/111] Revert "netfilter: x_tables: Update remaining dereference to RCU" [5.4,097/111] ACPI: scan: Rearrange memory allocation in acpi_device_add() [5.4,098/111] ACPI: scan: Use unique number for instance_no [5.4,099/111] perf auxtrace: Fix auxtrace queue conflict [5.4,100/111] block: recalculate segment count for multi-segment discards correctly [5.4,101/111] scsi: Revert "qla2xxx: Make sure that aborted commands are freed" [5.4,102/111] scsi: qedi: Fix error return code of qedi_alloc_global_queues() [5.4,103/111] scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() [5.4,104/111] locking/mutex: Fix non debug version of mutex_lock_io_nested() [5.4,105/111] x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc() [5.4,106/111] can: dev: Move device back to init netns on owning netns delete [5.4,107/111] net: dsa: b53: VLAN filtering is global to all users [5.4,108/111] net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() [5.4,109/111] mac80211: fix double free in ibss_leave [5.4,110/111] ext4: add reclaim checks to xattr code [5.4,111/111] can: peak_usb: Revert "can: peak_usb: add forgotten supported devices"

[5.4,050/111] integrity: double check iint_cache was initialized

Commit Message

Patch