Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

ima: fix invalid memory reference

Browse source 
Don't free a valid measurement entry on TPM PCR extend failure.

Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Cc: stable@vger.kernel.org
This commit is contained in:
Roberto Sassu 2011-12-19 15:57:28 +01:00 committed by Mimi Zohar
parent 45fae74939
commit 7b7e5916aa
1 changed files with 11 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
security/integrity/ima/ima_queue.c
View file

@ -23,6 +23,8 @@
#include <linux/slab.h> #include <linux/slab.h>
#include "ima.h" #include "ima.h"
#define AUDIT_CAUSE_LEN_MAX 32
LIST_HEAD(ima_measurements); /* list of all measurements */ LIST_HEAD(ima_measurements); /* list of all measurements */
/* key: inode (before secure-hashing a file) */ /* key: inode (before secure-hashing a file) */
@ -94,7 +96,8 @@ static int ima_pcr_extend(const u8 *hash)
result = tpm_pcr_extend(TPM_ANY_NUM, CONFIG_IMA_MEASURE_PCR_IDX, hash); result = tpm_pcr_extend(TPM_ANY_NUM, CONFIG_IMA_MEASURE_PCR_IDX, hash);
if (result != 0) if (result != 0)
pr_err("IMA: Error Communicating to TPM chip\n"); pr_err("IMA: Error Communicating to TPM chip, result: %d\n",
result);
return result; return result;
} }
@ -106,8 +109,9 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
{ {
u8 digest[IMA_DIGEST_SIZE]; u8 digest[IMA_DIGEST_SIZE];
const char *audit_cause = "hash_added"; const char *audit_cause = "hash_added";
char tpm_audit_cause[AUDIT_CAUSE_LEN_MAX];
int audit_info = 1; int audit_info = 1;
int result = 0; int result = 0, tpmresult = 0;
mutex_lock(&ima_extend_list_mutex); mutex_lock(&ima_extend_list_mutex);
if (!violation) { if (!violation) {
@ -129,9 +133,11 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
if (violation) /* invalidate pcr */ if (violation) /* invalidate pcr */
memset(digest, 0xff, sizeof digest); memset(digest, 0xff, sizeof digest);
result = ima_pcr_extend(digest); tpmresult = ima_pcr_extend(digest);
if (result != 0) { if (tpmresult != 0) {
audit_cause = "TPM error"; snprintf(tpm_audit_cause, AUDIT_CAUSE_LEN_MAX, "TPM_error(%d)",
tpmresult);
audit_cause = tpm_audit_cause;
audit_info = 0; audit_info = 0;
} }
out: out: