Re: [PATCH] Fixing returning a userspace address for return value

---
 security/security.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/security/security.c b/security/security.c
index 9ffa9e9c5c55..7c41b5d732ab 100644
--- a/security/security.c
+++ b/security/security.c

@@ -1737,6 +1737,8 @@ int security_kernel_read_file(struct file *file, enum

kernel_read_file_id id,
        int ret;

        ret = call_int_hook(kernel_read_file, 0, file, id, contents);
+       if (ret > 0)
+               return -EINVAL;
        if (ret)
                return ret;
        return ima_read_file(file, id, contents);
-- 
2.25.1

This commit is to fix a userspace address dereference found by
syzkaller.
The crash is triggered by passing a file descriptor to an incorrectly
formed kernel module to finit_module.

Kernel/module.c:4175 : Within the finit_module, info.len is set to the
return value from kernel_read_file_from_fd. This value is then
dereferenced by memcmp within module_sig_check from inside load_module.
The value is 0xb000000 so the kernel dereferences user memory and kernel
panics.

To prevent this adding a check from within security_kernel_read_file to
make sure call_int_hook doesn't return an address which in the syzkaller
program is what causes the return value to be 0xb000000. Then the return
value of security_kernel_read_file is returned to kernel_read_file(also
in security/security.c) which returns the value to
kernel_read_file_from_fd (fs/kernel_read_file.c) and this returns the
value into err then being set to info.len causing the dereference when
info is passed into load_module.