system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-06 01:40:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "evm: Fix memleak in init_desc"

Browse source 
This reverts commit ccf11dbaa0.

Commit ccf11dbaa0 ("evm: Fix memleak in init_desc") said there is
memleak in init_desc. That may be incorrect, as we can see, tmp_tfm is
saved in one of the two global variables hmac_tfm or evm_tfm[hash_algo],
then if init_desc is called next time, there is no need to alloc tfm
again, so in the error path of kmalloc desc or crypto_shash_init(desc),
It is not a problem without freeing tmp_tfm.

And also that commit did not reset the global variable to NULL after
freeing tmp_tfm and this makes *tfm a dangling pointer which may cause a
UAF issue.

Reported-by: Guozihua (Scott) <guozihua@huawei.com>
Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Xiu Jianfeng 2022-05-27 19:17:26 +08:00 committed by Mimi Zohar
parent b13baccc38
commit 51dd64bb99
1 changed files with 2 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
security/integrity/evm/evm_crypto.c
View file

@ -75,7 +75,7 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
{
long rc;
const char *algo;
struct crypto_shash **tfm, *tmp_tfm = NULL;
struct crypto_shash **tfm, *tmp_tfm;
struct shash_desc *desc;
if (type == EVM_XATTR_HMAC) {
@ -120,16 +120,13 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
alloc:
desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(*tfm),
GFP_KERNEL);
if (!desc) {
crypto_free_shash(tmp_tfm);
if (!desc)
return ERR_PTR(-ENOMEM);
}
desc->tfm = *tfm;
rc = crypto_shash_init(desc);
if (rc) {
crypto_free_shash(tmp_tfm);
kfree(desc);
return ERR_PTR(rc);
}