Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-23 Thread Ethan Zhao
Davidlohr， I read your commit 53dad6d3a8e5ac1af8bacc6ac2134ae1a8b085f1, ipc: fix race with LSMs The issue we hit without the above patch, the race may happen when process call semctl with IPC_RMID just as Manfred Spraul mentioned: Thread A: IPC_RMID -> freeary()

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-23 Thread Ethan Zhao
Davidlohr， I read your commit 53dad6d3a8e5ac1af8bacc6ac2134ae1a8b085f1, ipc: fix race with LSMs The issue we hit without the above patch, the race may happen when process call semctl with IPC_RMID just as Manfred Spraul mentioned: Thread A: IPC_RMID - freeary()

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread Davidlohr Bueso
On Fri, 2015-01-23 at 10:19 +0800, ethan zhao wrote: > > If not, what kernel > > version were you running when you triggered the bug? > To be honest, a kernel from distro, but not released, but before we > get it clear, we wouldn't public more. Sheesh, could Oracle be any more (ridiculously)

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread ethan zhao
Davidlohr, On 2015/1/23 4:48, Davidlohr Bueso wrote: On Thu, 2015-01-22 at 14:05 -0500, Stephen Smalley wrote: On Wed, Jan 21, 2015 at 9:44 PM, Ethan Zhao wrote: On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul wrote: On 01/21/2015 04:53 AM, Ethan Zhao wrote: On Tue, Jan 20, 2015 at 10:10

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread ethan zhao
Stephen, On 2015/1/23 3:05, Stephen Smalley wrote: On Wed, Jan 21, 2015 at 9:44 PM, Ethan Zhao wrote: On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul wrote: On 01/21/2015 04:53 AM, Ethan Zhao wrote: On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley wrote: On 01/20/2015 04:18 AM, Ethan

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread ethan zhao
Manfred, On 2015/1/23 2:15, Manfred Spraul wrote: On 01/22/2015 03:44 AM, Ethan Zhao wrote: On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul wrote: On 01/21/2015 04:53 AM, Ethan Zhao wrote: On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley wrote: On 01/20/2015 04:18 AM, Ethan Zhao wrote:

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread Davidlohr Bueso
On Thu, 2015-01-22 at 14:05 -0500, Stephen Smalley wrote: > On Wed, Jan 21, 2015 at 9:44 PM, Ethan Zhao wrote: > > On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul > > wrote: > >> On 01/21/2015 04:53 AM, Ethan Zhao wrote: > >>> > >>> On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley > >>> wrote:

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread Stephen Smalley
On Wed, Jan 21, 2015 at 9:44 PM, Ethan Zhao wrote: > On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul > wrote: >> On 01/21/2015 04:53 AM, Ethan Zhao wrote: >>> >>> On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley >>> wrote: On 01/20/2015 04:18 AM, Ethan Zhao wrote: > >

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread Manfred Spraul
On 01/22/2015 03:44 AM, Ethan Zhao wrote: On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul wrote: On 01/21/2015 04:53 AM, Ethan Zhao wrote: On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley wrote: On 01/20/2015 04:18 AM, Ethan Zhao wrote: sys_semget() ->newary()

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread ethan zhao
Manfred, On 2015/1/23 2:15, Manfred Spraul wrote: On 01/22/2015 03:44 AM, Ethan Zhao wrote: On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul manf...@colorfullife.com wrote: On 01/21/2015 04:53 AM, Ethan Zhao wrote: On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley s...@tycho.nsa.gov wrote:

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread ethan zhao
Stephen, On 2015/1/23 3:05, Stephen Smalley wrote: On Wed, Jan 21, 2015 at 9:44 PM, Ethan Zhao ethan.ker...@gmail.com wrote: On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul manf...@colorfullife.com wrote: On 01/21/2015 04:53 AM, Ethan Zhao wrote: On Tue, Jan 20, 2015 at 10:10 PM, Stephen

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread ethan zhao
Davidlohr, On 2015/1/23 4:48, Davidlohr Bueso wrote: On Thu, 2015-01-22 at 14:05 -0500, Stephen Smalley wrote: On Wed, Jan 21, 2015 at 9:44 PM, Ethan Zhao ethan.ker...@gmail.com wrote: On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul manf...@colorfullife.com wrote: On 01/21/2015 04:53 AM,

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread Davidlohr Bueso
On Fri, 2015-01-23 at 10:19 +0800, ethan zhao wrote: If not, what kernel version were you running when you triggered the bug? To be honest, a kernel from distro, but not released, but before we get it clear, we wouldn't public more. Sheesh, could Oracle be any more (ridiculously)

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread Stephen Smalley
On Wed, Jan 21, 2015 at 9:44 PM, Ethan Zhao ethan.ker...@gmail.com wrote: On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul manf...@colorfullife.com wrote: On 01/21/2015 04:53 AM, Ethan Zhao wrote: On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley s...@tycho.nsa.gov wrote: On 01/20/2015

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread Manfred Spraul
On 01/22/2015 03:44 AM, Ethan Zhao wrote: On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul manf...@colorfullife.com wrote: On 01/21/2015 04:53 AM, Ethan Zhao wrote: On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley s...@tycho.nsa.gov wrote: On 01/20/2015 04:18 AM, Ethan Zhao wrote:

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-22 Thread Davidlohr Bueso
On Thu, 2015-01-22 at 14:05 -0500, Stephen Smalley wrote: On Wed, Jan 21, 2015 at 9:44 PM, Ethan Zhao ethan.ker...@gmail.com wrote: On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul manf...@colorfullife.com wrote: On 01/21/2015 04:53 AM, Ethan Zhao wrote: On Tue, Jan 20, 2015 at 10:10 PM,

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-21 Thread Ethan Zhao
On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul wrote: > On 01/21/2015 04:53 AM, Ethan Zhao wrote: >> >> On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley >> wrote: >>> >>> On 01/20/2015 04:18 AM, Ethan Zhao wrote: sys_semget() ->newary()

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-21 Thread Ethan Zhao
On Wed, Jan 21, 2015 at 1:30 PM, Manfred Spraul manf...@colorfullife.com wrote: On 01/21/2015 04:53 AM, Ethan Zhao wrote: On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley s...@tycho.nsa.gov wrote: On 01/20/2015 04:18 AM, Ethan Zhao wrote: sys_semget() -newary()

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Manfred Spraul
On 01/21/2015 04:53 AM, Ethan Zhao wrote: On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley wrote: On 01/20/2015 04:18 AM, Ethan Zhao wrote: sys_semget() ->newary() ->security_sem_alloc() ->sem_alloc_security() selinux_sem_alloc_security()

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Ethan Zhao
On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley wrote: > On 01/20/2015 04:18 AM, Ethan Zhao wrote: >> A NULL pointer dereference was observed as following panic: >> >> BUG: unable to handle kernel NULL pointer dereference at (null) >> IP: [] ipc_has_perm+0x4b/0x60 >> ... >> Process opcmon (pid:

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread ethan zhao
Stephen, On 2015/1/21 2:49, Manfred Spraul wrote: Hi, On 01/20/2015 03:10 PM, Stephen Smalley wrote: On 01/20/2015 04:18 AM, Ethan Zhao wrote: A NULL pointer dereference was observed as following panic: BUG: unable to handle kernel NULL pointer dereference at (null) IP: []

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Stephen Smalley
On 01/20/2015 04:06 PM, Eric Paris wrote: > What kernel version was this? Didn't we have this problem and solve it > upstream some time ago? IPC could be allocated with a valid security > context, the ipc would be freed. the isec was free'd syncronously, but > then the ipc could stick around

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Eric Paris
What kernel version was this? Didn't we have this problem and solve it upstream some time ago? IPC could be allocated with a valid security context, the ipc would be freed. the isec was free'd syncronously, but then the ipc could stick around until some rcu period or some usage flag got to 0,

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Stephen Smalley
On 01/20/2015 01:49 PM, Manfred Spraul wrote: > Hi, > > On 01/20/2015 03:10 PM, Stephen Smalley wrote: >> On 01/20/2015 04:18 AM, Ethan Zhao wrote: >>> A NULL pointer dereference was observed as following panic: >>> >>> BUG: unable to handle kernel NULL pointer dereference at (null) >>> IP: []

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Manfred Spraul
Hi, On 01/20/2015 03:10 PM, Stephen Smalley wrote: On 01/20/2015 04:18 AM, Ethan Zhao wrote: A NULL pointer dereference was observed as following panic: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] ipc_has_perm+0x4b/0x60 ... Process opcmon (pid: 30712, threadinfo

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Stephen Smalley
On 01/20/2015 04:18 AM, Ethan Zhao wrote: > A NULL pointer dereference was observed as following panic: > > BUG: unable to handle kernel NULL pointer dereference at (null) > IP: [] ipc_has_perm+0x4b/0x60 > ... > Process opcmon (pid: 30712, threadinfo 880237f2a000, > task 88022ac70e40) >

[PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Ethan Zhao
A NULL pointer dereference was observed as following panic: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] ipc_has_perm+0x4b/0x60 ... Process opcmon (pid: 30712, threadinfo 880237f2a000, task 88022ac70e40) Stack: 880237f2bc04 01020953 880237f2bce8

[PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Ethan Zhao
A NULL pointer dereference was observed as following panic: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [812735eb] ipc_has_perm+0x4b/0x60 ... Process opcmon (pid: 30712, threadinfo 880237f2a000, task 88022ac70e40) Stack: 880237f2bc04 01020953

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Stephen Smalley
On 01/20/2015 04:18 AM, Ethan Zhao wrote: A NULL pointer dereference was observed as following panic: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [812735eb] ipc_has_perm+0x4b/0x60 ... Process opcmon (pid: 30712, threadinfo 880237f2a000, task

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Manfred Spraul
Hi, On 01/20/2015 03:10 PM, Stephen Smalley wrote: On 01/20/2015 04:18 AM, Ethan Zhao wrote: A NULL pointer dereference was observed as following panic: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [812735eb] ipc_has_perm+0x4b/0x60 ... Process opcmon (pid:

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Eric Paris
What kernel version was this? Didn't we have this problem and solve it upstream some time ago? IPC could be allocated with a valid security context, the ipc would be freed. the isec was free'd syncronously, but then the ipc could stick around until some rcu period or some usage flag got to 0,

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Stephen Smalley
On 01/20/2015 01:49 PM, Manfred Spraul wrote: Hi, On 01/20/2015 03:10 PM, Stephen Smalley wrote: On 01/20/2015 04:18 AM, Ethan Zhao wrote: A NULL pointer dereference was observed as following panic: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [812735eb]

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread ethan zhao
Stephen, On 2015/1/21 2:49, Manfred Spraul wrote: Hi, On 01/20/2015 03:10 PM, Stephen Smalley wrote: On 01/20/2015 04:18 AM, Ethan Zhao wrote: A NULL pointer dereference was observed as following panic: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [812735eb]

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Manfred Spraul
On 01/21/2015 04:53 AM, Ethan Zhao wrote: On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley s...@tycho.nsa.gov wrote: On 01/20/2015 04:18 AM, Ethan Zhao wrote: sys_semget() -newary() -security_sem_alloc() -sem_alloc_security()

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Stephen Smalley
On 01/20/2015 04:06 PM, Eric Paris wrote: What kernel version was this? Didn't we have this problem and solve it upstream some time ago? IPC could be allocated with a valid security context, the ipc would be freed. the isec was free'd syncronously, but then the ipc could stick around until

Re: [PATCH] Selinux/hooks.c: Fix a NULL pointer dereference caused by semop()

2015-01-20 Thread Ethan Zhao
On Tue, Jan 20, 2015 at 10:10 PM, Stephen Smalley s...@tycho.nsa.gov wrote: On 01/20/2015 04:18 AM, Ethan Zhao wrote: A NULL pointer dereference was observed as following panic: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [812735eb] ipc_has_perm+0x4b/0x60 ...