TechPanelGM/kernel_xiaomi_sm8250
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

integrity: Fix possible multiple allocation in integrity_inode_get()

Browse Source 
commit 9df6a4870dc371136e90330cfbbc51464ee66993 upstream.

When integrity_inode_get() is querying and inserting the cache, there
is a conditional race in the concurrent environment.

The race condition is the result of not properly implementing
"double-checked locking". In this case, it first checks to see if the
iint cache record exists before taking the lock, but doesn't check
again after taking the integrity_iint_lock.

Fixes: bf2276d10c ("ima: allocating iint improvements")
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc: <stable@vger.kernel.org> # v3.10+
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Tianjia Zhang
2023-06-01 14:42:44 +08:00
committed by Greg Kroah-Hartman
parent fe75e8a0c2
commit 2a3ff660cc
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
security/integrity/iint.c
View File

@@ -46,12 +46,10 @@ static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode)
else if (inode > iint->inode) else if (inode > iint->inode)
n = n->rb_right; n = n->rb_right;
else else
break; return iint;
} }
if (!n)
return NULL;
return iint; return NULL;
} }
/* /*
@@ -116,10 +114,15 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode)
parent = *p; parent = *p;
test_iint = rb_entry(parent, struct integrity_iint_cache, test_iint = rb_entry(parent, struct integrity_iint_cache,
rb_node); rb_node);
if (inode < test_iint->inode) if (inode < test_iint->inode) {
p = &(*p)->rb_left; p = &(*p)->rb_left;
else } else if (inode > test_iint->inode) {
p = &(*p)->rb_right; p = &(*p)->rb_right;
} else {
write_unlock(&integrity_iint_lock);
kmem_cache_free(iint_cache, iint);
return test_iint;
}
} }
iint->inode = inode; iint->inode = inode;