AZL-96507

In the Linux kernel, the following vulnerability has been resolved:

kernfs: link kn to its parent before the LSM init hook

After commit 12e9e3cd03b5 ("simpexattr: use per-sb cache"), kernfsxattrset() and kernfsxattrget() compute the cache via kernfsroot(kn) before any other check. kernfs_root(kn) walks kn->__parent first and falls back to kn->dir.root, both of which are NULL on a freshly kmemcachezalloc()'d kn. kn->__parent was being set in kernfsnewnode() after __kernfsnewnode() returned, and kn->dir.root is set even later by kernfscreatedirns() / kernfscreateemptydir().

The LSM kernfsinitsecurity hook is invoked from inside _kernfsnewnode(), before either field has been initialized. selinuxkernfsinitsecurity() ends with kernfsxattrset(kn, XATTRNAMESELINUX, ...). kernfsroot(kn) then returns NULL, and &((struct kernfsroot *)NULL)->xacache evaluates to offsetof(struct kernfsroot, xa_cache) which faults:

BUG: kernel NULL pointer dereference, address: 00000000000000e0 RIP: 0010:simplexattrset+0x27/0x8b0 Call Trace: kernfsxattrset+0x63/0xb0 selinuxkernfsinitsecurity+0x13b/0x270 securitykernfsinitsecurity+0x36/0xc0 _kernfsnewnode+0x182/0x290 kernfsnewnode+0x80/0xc0 kernfscreatedirns+0x2b/0xa0 cgroupcreate+0x116/0x380 cgroupmkdir+0x7c/0x1a0

Reproduces deterministically at PID 1 (systemd) on an SELinux-enabled distro. The first cgroup mkdir under /sys/fs/cgroup with a labelled parent panics the kernel.

The LSM hook's contract is that the kn_dir argument is the parent of the new kn, so kn->__parent should already point at kndir when the hook runs. Move kernfsget(parent) and rcuassignpointer of kn->__parent from kernfsnewnode() into __kernfsnewnode() right before the security hook, and unwind the parent reference on the errout4 path. kernfsroot(kn) then takes its parent branch during the hook and returns parent->dir.root, which is the correct root.

This also closes the same-shape latent bug in kernfsxattrget() (which today is hidden only by kernfsiattrsnoalloc() returning NULL on a fresh kn).