lkml.org 
[lkml]   [2022]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 034/231] Revert "evm: Fix memleak in init_desc"
    Date
    From: Xiu Jianfeng <xiujianfeng@huawei.com>

    commit 51dd64bb99e4478fc5280171acd8e1b529eadaf7 upstream.

    This reverts commit ccf11dbaa07b328fa469415c362d33459c140a37.

    Commit ccf11dbaa07b ("evm: Fix memleak in init_desc") said there is
    memleak in init_desc. That may be incorrect, as we can see, tmp_tfm is
    saved in one of the two global variables hmac_tfm or evm_tfm[hash_algo],
    then if init_desc is called next time, there is no need to alloc tfm
    again, so in the error path of kmalloc desc or crypto_shash_init(desc),
    It is not a problem without freeing tmp_tfm.

    And also that commit did not reset the global variable to NULL after
    freeing tmp_tfm and this makes *tfm a dangling pointer which may cause a
    UAF issue.

    Reported-by: Guozihua (Scott) <guozihua@huawei.com>
    Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
    Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    security/integrity/evm/evm_crypto.c | 7 ++-----
    1 file changed, 2 insertions(+), 5 deletions(-)

    --- a/security/integrity/evm/evm_crypto.c
    +++ b/security/integrity/evm/evm_crypto.c
    @@ -75,7 +75,7 @@ static struct shash_desc *init_desc(char
    {
    long rc;
    const char *algo;
    - struct crypto_shash **tfm, *tmp_tfm = NULL;
    + struct crypto_shash **tfm, *tmp_tfm;
    struct shash_desc *desc;

    if (type == EVM_XATTR_HMAC) {
    @@ -120,16 +120,13 @@ unlock:
    alloc:
    desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(*tfm),
    GFP_KERNEL);
    - if (!desc) {
    - crypto_free_shash(tmp_tfm);
    + if (!desc)
    return ERR_PTR(-ENOMEM);
    - }

    desc->tfm = *tfm;

    rc = crypto_shash_init(desc);
    if (rc) {
    - crypto_free_shash(tmp_tfm);
    kfree(desc);
    return ERR_PTR(rc);
    }

    \
     
     \ /
      Last update: 2022-07-19 14:55    [W:2.143 / U:0.360 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site