Re: NULL pointer dereference in selinux_ip_postroute_compat

[John Stultz]

On 08/07/2012 03:37 PM, John Stultz wrote:
> On 08/07/2012 03:17 PM, Serge E. Hallyn wrote:
> > Quoting Paul Moore (paul@xxxxxxxxxxxxxx):
> > > On Tue, Aug 7, 2012 at 5:58 PM, John Stultz <john.stultz@xxxxxxxxxx> 
> > > wrote:
> > > > On 08/07/2012 02:50 PM, Paul Moore wrote:
> > > > > On Tue, Aug 7, 2012 at 2:12 PM, John Stultz <john.stultz@xxxxxxxxxx>
> > > > > wrote:
> > > > > > Hi,
> > > > > >       With my kvm environment using 3.6-rc1+, I'm seeing NULL 
> > > > > > pointer
> > > > > > dereferences in selinux_ip_postroute_compat(). It looks like the 
> > > > > > sksec
> > > > > > value
> > > > > > is null and we die in the following line:
> > > > > >
> > > > > >       if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
> > > > > >
> > > > > > This triggers every time I shutdown the machine, but has also 
> > > > > > triggered
> > > > > > randomly after a few hours.
[snip]
> > The problem seems to be that selinux_nf_ip_init() was called, which
> > registers the selinux_ipv4_ops (and ipv6).  Those should not get 
> > registered
> > if selinux ends up not being loaded (as in, if apparmor is loaded 
> > first),
> > since as you've found here the selinux lsm hooks won't be called to set
> > call selinux_sk_alloc_security().
> This sounds about right:
> root@testvm:~# dmesg | grep SELinux
> [    0.004578] SELinux:  Initializing.
> [    0.005704] SELinux:  Starting in permissive mode
> [    2.235034] SELinux:  Registering netfilter hooks
>
> > I assume what's happening is that 
> > CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE was
> > set to 1, but selinux ended up being set to disabled after the
> > __initcall(selinux_nf_ip_init) ran?  Weird.
> This looks right as well:
>
> # zcat config.gz | grep SELINUX
> CONFIG_SECURITY_SELINUX=y
> CONFIG_SECURITY_SELINUX_BOOTPARAM=y
> CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=1
> CONFIG_SECURITY_SELINUX_DISABLE=y
> CONFIG_SECURITY_SELINUX_DEVELOP=y
> CONFIG_SECURITY_SELINUX_AVC_STATS=y
> CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
> # CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set
> CONFIG_DEFAULT_SECURITY_SELINUX=y
>
>
> Since the problem isn't completely obvious, I'm starting a bisection 
> to narrow this down some more.

So I bisected this down and it seems to be the following commit:

commit be9f4a44e7d41cee50ddb5f038fc2391cbbb4046
Author: Eric Dumazet <edumazet@xxxxxxxxxx>
Date:   Thu Jul 19 07:34:03 2012 +0000

    ipv4: tcp: remove per net tcp_sock


It doesn't revert totally cleanly, but after fixing up the rejections 
and booting with this patch removed on top of Linus' head the oops on 
shutdown goes away.

thanks
-john


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/