Re: v5.1-rc1 binder_alloc_do_buffer_copy() BUG_ON triggered by selinux-testsuite

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Mar 19, 2019 at 3:08 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
>
> On Tue, Mar 19, 2019 at 3:33 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
> > On Tue, Mar 19, 2019 at 12:51 PM Todd Kjos <tkjos@xxxxxxxxxx> wrote:
> > > Paul,
> > >
> > > I think this patch will fix it... can you run the selinux-testsuite
> > > with the patch to verify? (the conditional assumed that size_t can go
> > > negative)
> >
> > Building a test kernel now, I'll report back as soon as it is finished.
>
> Good news, the BUG_ON() panic is now gone,

Great. Thanks for testing it.

> but I'm seeing a test
> failure, although to be fair I saw some binder test failures during
> the merge window (I generally don't worry about failures until -rc1 is
> released).  The selinux-testsuite binder tests have been working since
> spring 2018, but it's possible there might be a bug in the tests that
> is just now showing up.  Have you ever looked at the selinux-testsuite
> tests for binder?

No, I didn't know they existed until yesterday. Glad to have more test
coverage. Were they running clean on 5.0.0?

Is there a public dashboard where I can take a look at those binder failures?

-Todd

>
> * https://github.com/SELinuxProject/selinux-testsuite/tree/master/tests/binder
>
> > > diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> > > index 9a7c431469b3..bb9a661ffecc 100644
> > > --- a/drivers/android/binder.c
> > > +++ b/drivers/android/binder.c
> > > @@ -2240,7 +2240,8 @@ static size_t binder_get_object(struct binder_proc *proc,
> > >         size_t object_size = 0;
> > >
> > >         read_size = min_t(size_t, sizeof(*object), buffer->data_size - offset);
> > > -       if (read_size < sizeof(*hdr) || !IS_ALIGNED(offset, sizeof(u32)))
> > > +       if (offset > buffer->data_size || read_size < sizeof(*hdr) ||
> > > +                       !IS_ALIGNED(offset, sizeof(u32)))
> > >                 return 0;
> > >         binder_alloc_copy_from_buffer(&proc->alloc, object, buffer,
> > >                                       offset, read_size);
> > >
> > > On Mon, Mar 18, 2019 at 4:02 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
> > > >
> > > > On Mon, Mar 18, 2019 at 6:51 PM Todd Kjos <tkjos@xxxxxxxxxx> wrote:
> > > > > On Mon, Mar 18, 2019 at 2:31 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
> > > > > > Hello all.
> > > > > >
> > > > > > When running the selinux-testsuite (link below) against v5.1-rc1 I hit
> > > > > > the BUG_ON() at the top of binder_alloc_do_buffer_copy() (trace
> > > > > > below).  I'm hoping this is a known issue with a fix already in the
> > > > > > works?
> > > > >
> > > > >
> > > > > Sadly, this is the first report of this, so no fix in flight. I'll try
> > > > > to get a fix up in the next few days.
> > > >
> > > > No problem, thanks for letting me know.  If you need some testing
> > > > help, let me know.
>
> --
> paul moore
> www.paul-moore.com



[Index of Archives]     [Selinux Refpolicy]     [Linux SGX]     [Fedora Users]     [Fedora Desktop]     [Yosemite Photos]     [Yosemite Camping]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux