lkml.org 
[lkml]   [2021]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 224/593] evm: fix writing <securityfs>/evm overflow
    Date
    From: Mimi Zohar <zohar@linux.ibm.com>

    [ Upstream commit 49219d9b8785ba712575c40e48ce0f7461254626 ]

    EVM_SETUP_COMPLETE is defined as 0x80000000, which is larger than INT_MAX.
    The "-fno-strict-overflow" compiler option properly prevents signaling
    EVM that the EVM policy setup is complete. Define and read an unsigned
    int.

    Fixes: f00d79750712 ("EVM: Allow userspace to signal an RSA key has been loaded")
    Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/integrity/evm/evm_secfs.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c
    index a7042ae90b9e..bc10c945f3ed 100644
    --- a/security/integrity/evm/evm_secfs.c
    +++ b/security/integrity/evm/evm_secfs.c
    @@ -66,12 +66,13 @@ static ssize_t evm_read_key(struct file *filp, char __user *buf,
    static ssize_t evm_write_key(struct file *file, const char __user *buf,
    size_t count, loff_t *ppos)
    {
    - int i, ret;
    + unsigned int i;
    + int ret;

    if (!capable(CAP_SYS_ADMIN) || (evm_initialized & EVM_SETUP_COMPLETE))
    return -EPERM;

    - ret = kstrtoint_from_user(buf, count, 0, &i);
    + ret = kstrtouint_from_user(buf, count, 0, &i);

    if (ret)
    return ret;
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-12 09:10    [W:2.468 / U:0.612 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site