lkml.org 
[lkml]   [2020]   [Aug]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.8 241/464] ima: Free the entire rule if it fails to parse
    Date
    From: Tyler Hicks <tyhicks@linux.microsoft.com>

    [ Upstream commit 2bdd737c5687d6dec30e205953146ede8a87dbdd ]

    Use ima_free_rule() to fix memory leaks of allocated ima_rule_entry
    members, such as .fsname and .keyrings, when an error is encountered
    during rule parsing.

    Set the args_p pointer to NULL after freeing it in the error path of
    ima_lsm_rule_init() so that it isn't freed twice.

    This fixes a memory leak seen when loading an rule that contains an
    additional piece of allocated memory, such as an fsname, followed by an
    invalid conditional:

    # echo "measure fsname=tmpfs bad=cond" > /sys/kernel/security/ima/policy
    -bash: echo: write error: Invalid argument
    # echo scan > /sys/kernel/debug/kmemleak
    # cat /sys/kernel/debug/kmemleak
    unreferenced object 0xffff98e7e4ece6c0 (size 8):
    comm "bash", pid 672, jiffies 4294791843 (age 21.855s)
    hex dump (first 8 bytes):
    74 6d 70 66 73 00 6b a5 tmpfs.k.
    backtrace:
    [<00000000abab7413>] kstrdup+0x2e/0x60
    [<00000000f11ede32>] ima_parse_add_rule+0x7d4/0x1020
    [<00000000f883dd7a>] ima_write_policy+0xab/0x1d0
    [<00000000b17cf753>] vfs_write+0xde/0x1d0
    [<00000000b8ddfdea>] ksys_write+0x68/0xe0
    [<00000000b8e21e87>] do_syscall_64+0x56/0xa0
    [<0000000089ea7b98>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

    Fixes: f1b08bbcbdaf ("ima: define a new policy condition based on the filesystem name")
    Fixes: 2b60c0ecedf8 ("IMA: Read keyrings= option from the IMA policy")
    Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
    Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/integrity/ima/ima_policy.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
    index 641582230861c..18271920d315d 100644
    --- a/security/integrity/ima/ima_policy.c
    +++ b/security/integrity/ima/ima_policy.c
    @@ -913,6 +913,7 @@ static int ima_lsm_rule_init(struct ima_rule_entry *entry,

    if (ima_rules == &ima_default_rules) {
    kfree(entry->lsm[lsm_rule].args_p);
    + entry->lsm[lsm_rule].args_p = NULL;
    result = -EINVAL;
    } else
    result = 0;
    @@ -1404,7 +1405,7 @@ ssize_t ima_parse_add_rule(char *rule)

    result = ima_parse_rule(p, entry);
    if (result) {
    - kfree(entry);
    + ima_free_rule(entry);
    integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
    NULL, op, "invalid-policy", result,
    audit_info);
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-08-17 21:36    [W:4.071 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site