On Wed, Jun 15, 2022 at 11:39 AM Christian Göttsche
<cgzones@xxxxxxxxxxxxxx> wrote:
>
> `selinux_add_opt()` stopped taking ownership of the passed context since
> commit 70f4169ab421 ("selinux: parse contexts for mount options early").
>
> unreferenced object 0xffff888114dfd140 (size 64):
> comm "mount", pid 15182, jiffies 4295687028 (age 796.340s)
> hex dump (first 32 bytes):
> 73 79 73 74 65 6d 5f 75 3a 6f 62 6a 65 63 74 5f system_u:object_
> 72 3a 74 65 73 74 5f 66 69 6c 65 73 79 73 74 65 r:test_filesyste
> backtrace:
> [<ffffffffa07dbef4>] kmemdup_nul+0x24/0x80
> [<ffffffffa0d34253>] selinux_sb_eat_lsm_opts+0x293/0x560
> [<ffffffffa0d13f08>] security_sb_eat_lsm_opts+0x58/0x80
> [<ffffffffa0af1eb2>] generic_parse_monolithic+0x82/0x180
> [<ffffffffa0a9c1a5>] do_new_mount+0x1f5/0x550
> [<ffffffffa0a9eccb>] path_mount+0x2ab/0x1570
> [<ffffffffa0aa019e>] __x64_sys_mount+0x20e/0x280
> [<ffffffffa1f47124>] do_syscall_64+0x34/0x80
> [<ffffffffa200007e>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
>
> unreferenced object 0xffff888108e71640 (size 64):
> comm "fsmount", pid 7607, jiffies 4295044974 (age 1601.016s)
> hex dump (first 32 bytes):
> 73 79 73 74 65 6d 5f 75 3a 6f 62 6a 65 63 74 5f system_u:object_
> 72 3a 74 65 73 74 5f 66 69 6c 65 73 79 73 74 65 r:test_filesyste
> backtrace:
> [<ffffffff861dc2b1>] memdup_user+0x21/0x90
> [<ffffffff861dc367>] strndup_user+0x47/0xa0
> [<ffffffff864f6965>] __do_sys_fsconfig+0x485/0x9f0
> [<ffffffff87940124>] do_syscall_64+0x34/0x80
> [<ffffffff87a0007e>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
>
> Fixes: 70f4169ab421 ("selinux: parse contexts for mount options early")
> Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
> ---
> security/selinux/hooks.c | 11 ++++-------
> 1 file changed, 4 insertions(+), 7 deletions(-)
Thanks Christian, I've merged this into selinux/stable-5.19 and I'll
send this up to Linus once the automated tests come back clean.
--
paul-moore.com
