syzbot


UBSAN: array-index-out-of-bounds in ima_inode_setxattr

Status: fixed on 2021/11/10 00:50
Subsystems: integrity lsm
[Documentation on labels]
Reported-by: syzbot+e8bafe7b82c739eaf153@syzkaller.appspotmail.com
Fix commit: cb181da16196 IMA: reject unknown hash algorithms in ima_get_hash_algo
First crash: 1147d, last: 1145d
Cause bisection: introduced by (bisect log) [no-op commit]:
commit b9fc8b4a591811546fec2dbef7e9f809362100c9
Author: Grant Seltzer <grantseltzer@gmail.com>
Date: Mon Feb 22 19:58:46 2021 +0000

  bpf: Add kernel/modules BTF presence checks to bpftool feature command

Crash: WARNING in kvm_wait (log)
Repro: C syz .config
  
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] UBSAN: array-index-out-of-bounds in ima_inode_setxattr 0 (1) 2021/08/19 15:30
Last patch testing requests (2)
Created Duration User Patch Repo Result
2021/08/21 20:09 10m asha.16@itfac.mrt.ac.lk https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master report log
2021/08/20 07:29 16m simon.thoby@viveris.fr patch git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 33e65b1f975c OK

Sample crash report:
================================================================================
UBSAN: array-index-out-of-bounds in security/integrity/ima/ima_appraise.c:621:36
index 222 is out of range for type 'char *[20]'
CPU: 1 PID: 6550 Comm: syz-executor680 Not tainted 5.14.0-rc6-next-20210819-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:151
 __ubsan_handle_out_of_bounds.cold+0x64/0x70 lib/ubsan.c:291
 validate_hash_algo security/integrity/ima/ima_appraise.c:621 [inline]
 ima_inode_setxattr+0x536/0x540 security/integrity/ima/ima_appraise.c:656
 security_inode_setxattr+0x148/0x240 security/security.c:1355
 __vfs_setxattr_locked+0xa7/0x260 fs/xattr.c:266
 vfs_setxattr+0x14e/0x350 fs/xattr.c:301
 setxattr+0x21b/0x2b0 fs/xattr.c:575
 path_setxattr+0x19d/0x1d0 fs/xattr.c:595
 __do_sys_lsetxattr fs/xattr.c:618 [inline]
 __se_sys_lsetxattr fs/xattr.c:614 [inline]
 __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:614
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x43ee89
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe96b06768 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 0000000000400488 RCX: 000000000043ee89
RDX: 0000000020000140 RSI: 00000000200000c0 RDI: 0000000020000000
RBP: 0000000000402e70 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000000a R11: 0000000000000246 R12: 0000000000402f00
R13: 0000000000000000 R14: 00000000004ac018 R15: 0000000000400488
================================================================================
----------------
Code disassembly (best guess):
   0:	28 c3                	sub    %al,%bl
   2:	e8 2a 14 00 00       	callq  0x1431
   7:	66 2e 0f 1f 84 00 00 	nopw   %cs:0x0(%rax,%rax,1)
   e:	00 00 00 
  11:	48 89 f8             	mov    %rdi,%rax
  14:	48 89 f7             	mov    %rsi,%rdi
  17:	48 89 d6             	mov    %rdx,%rsi
  1a:	48 89 ca             	mov    %rcx,%rdx
  1d:	4d 89 c2             	mov    %r8,%r10
  20:	4d 89 c8             	mov    %r9,%r8
  23:	4c 8b 4c 24 08       	mov    0x8(%rsp),%r9
  28:	0f 05                	syscall 
  2a:	48 3d 01 f0 ff ff    	cmp    $0xfffffffffffff001,%rax <-- trapping instruction
  30:	73 01                	jae    0x33
  32:	c3                   	retq   
  33:	48 c7 c1 c0 ff ff ff 	mov    $0xffffffffffffffc0,%rcx
  3a:	f7 d8                	neg    %eax
  3c:	64 89 01             	mov    %eax,%fs:(%rcx)
  3f:	48                   	rex.W

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/08/19 14:36 linux-next 33e65b1f975c a2fe1cb5 .config console log report syz C ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in ima_inode_setxattr
2021/08/21 05:01 linux-next 86ed57fd8c93 b599f2fc .config console log report info ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in ima_inode_setxattr
2021/08/20 08:34 linux-next 33e65b1f975c b599f2fc .config console log report info ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in ima_inode_setxattr
2021/08/20 07:59 linux-next 33e65b1f975c b599f2fc .config console log report info ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in ima_inode_setxattr
2021/08/19 13:00 linux-next 33e65b1f975c a2fe1cb5 .config console log report info ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in ima_inode_setxattr
2021/08/19 10:27 linux-next 33e65b1f975c a2fe1cb5 .config console log report info ci-upstream-linux-next-kasan-gce-root UBSAN: array-index-out-of-bounds in ima_inode_setxattr
* Struck through repros no longer work on HEAD.