[syzbot] [lsm?] WARNING in free_ruleset

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 7d06015d936c Merge tag 'pci-v6.15-changes' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12c4fbb0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f2dde96545058477
dashboard link: https://syzkaller.appspot.com/bug?extid=8bca99e91de7e060e4ea
compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13380404580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=174f764c580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-7d06015d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a3714415ac07/vmlinux-7d06015d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/60a299508e73/Image-7d06015d.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8bca99...@syzkaller.appspotmail.com

el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
el0_svc+0x30/0xe0 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x10c/0x138 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:600
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 __ll_sc_atomic_fetch_sub_release arch/arm64/include/asm/atomic_ll_sc.h:96 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 raw_atomic_fetch_sub_release include/linux/atomic/atomic-arch-fallback.h:944 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:401 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 __refcount_sub_and_test include/linux/refcount.h:264 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 __refcount_dec_and_test include/linux/refcount.h:307 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 refcount_dec_and_test include/linux/refcount.h:325 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 landlock_put_hierarchy security/landlock/domain.h:164 [inline]
WARNING: CPU: 1 PID: 3298 at security/landlock/domain.h:133 free_ruleset+0x144/0x174 security/landlock/ruleset.c:490
Modules linked in:
CPU: 1 UID: 0 PID: 3298 Comm: syz-executor356 Not tainted 6.14.0-syzkaller-09584-g7d06015d936c #0 PREEMPT
Hardware name: linux,dummy-virt (DT)
pstate: 61402009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : landlock_free_hierarchy_details security/landlock/domain.h:133 [inline]
pc : landlock_put_hierarchy security/landlock/domain.h:168 [inline]
pc : free_ruleset+0x144/0x174 security/landlock/ruleset.c:490
lr : landlock_put_hierarchy security/landlock/domain.h:167 [inline]
lr : free_ruleset+0xdc/0x174 security/landlock/ruleset.c:490
sp : ffff800089483d30
x29: ffff800089483d30 x28: f7f0000005ba0000 x27: 0000000000000000
x26: 0000000000000000 x25: fcf000000415ca80 x24: fcf00000040a7438
x23: 00000000ffffffff x22: 0000000000000001 x21: fcf00000040a7420
x20: fcf00000040a7420 x19: f1f000000678ca00 x18: 00000000fffffffd
x17: 0000000000000000 x16: 0000000000000000 x15: ffff800089483270
x14: 00000000ffffffea x13: ffff800089483808 x12: ffff80008298eb10
x11: 0000000000000001 x10: 0000000000000001 x9 : 000000000002ffe8
x8 : f7f0000005ba0000 x7 : ffff800089483fd8 x6 : 00000000000affa8
x5 : fff000007f8e3588 x4 : ffff800089484000 x3 : 0000000000000000
x2 : fcf00000040a7458 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
__ll_sc_atomic_fetch_sub_release arch/arm64/include/asm/atomic_ll_sc.h:96 [inline] (P)
arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline] (P)
raw_atomic_fetch_sub_release include/linux/atomic/atomic-arch-fallback.h:944 [inline] (P)
atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:401 [inline] (P)
__refcount_sub_and_test include/linux/refcount.h:264 [inline] (P)
__refcount_dec_and_test include/linux/refcount.h:307 [inline] (P)
refcount_dec_and_test include/linux/refcount.h:325 [inline] (P)
landlock_put_hierarchy security/landlock/domain.h:164 [inline] (P)
free_ruleset+0x144/0x174 security/landlock/ruleset.c:490 (P)
landlock_put_ruleset security/landlock/ruleset.c:498 [inline]
landlock_put_ruleset security/landlock/ruleset.c:494 [inline]
__free_landlock_put_ruleset security/landlock/ruleset.h:200 [inline]
landlock_merge_ruleset+0x210/0x440 security/landlock/ruleset.c:534
__do_sys_landlock_restrict_self security/landlock/syscalls.c:549 [inline]
__se_sys_landlock_restrict_self security/landlock/syscalls.c:479 [inline]
__arm64_sys_landlock_restrict_self+0xb0/0x250 security/landlock/syscalls.c:479
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
el0_svc+0x30/0xe0 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x10c/0x138 arch/arm64/kernel/entry-common.c:762
el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:600
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Mickaël Salaün]

landlock_put_hierarchy() can be called when an error occurs in
landlock_merge_ruleset() due to insufficient memory. In this case, the
domain's audit details might not have been allocated yet, which would
cause landlock_free_hierarchy_details() to print a warning (but still
safely handle this case).

We could keep the WARN_ON_ONCE(!hierarchy) but it's not worth it for
this kind of function, so let's remove it entirely.

Cc: Günther Noack <gno...@google.com>
Cc: Paul Moore <pa...@paul-moore.com>
Reported-by: syzbot+8bca99...@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/67e919bf.050a022...@google.com
Signed-off-by: Mickaël Salaün <m...@digikod.net>
---
security/landlock/domain.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/landlock/domain.h b/security/landlock/domain.h
index ed0d348e214c..7fb70b25f85a 100644
--- a/security/landlock/domain.h
+++ b/security/landlock/domain.h
@@ -130,7 +130,7 @@ int landlock_init_hierarchy_log(struct landlock_hierarchy *const hierarchy);
static inline void
landlock_free_hierarchy_details(struct landlock_hierarchy *const hierarchy)
{
- if (WARN_ON_ONCE(!hierarchy || !hierarchy->details))
+ if (!hierarchy || !hierarchy->details)
return;

put_pid(hierarchy->details->pid);
--
2.49.0

[Günther Noack]

On Mon, Mar 31, 2025 at 12:47:07PM +0200, Mickaël Salaün wrote:
> landlock_put_hierarchy() can be called when an error occurs in
> landlock_merge_ruleset() due to insufficient memory. In this case, the
> domain's audit details might not have been allocated yet, which would
> cause landlock_free_hierarchy_details() to print a warning (but still
> safely handle this case).
>
> We could keep the WARN_ON_ONCE(!hierarchy) but it's not worth it for
> this kind of function, so let's remove it entirely.

Reviewed-by: Günther Noack <gno...@google.com>

-Günther