| From e386b9287718c94905465e5e7ed90f0e3c570bf8 Mon Sep 17 00:00:00 2001 |
| From: Sascha Hauer <s.hauer@pengutronix.de> |
| Date: Tue, 2 Jul 2019 10:00:41 +0200 |
| Subject: [PATCH] ima: fix freeing ongoing ahash_request |
| |
| commit 4ece3125f21b1d42b84896c5646dbf0e878464e1 upstream. |
| |
| integrity_kernel_read() can fail in which case we forward to call |
| ahash_request_free() on a currently running request. We have to wait |
| for its completion before we can free the request. |
| |
| This was observed by interrupting a "find / -type f -xdev -print0 | xargs -0 |
| cat 1>/dev/null" with ctrl-c on an IMA enabled filesystem. |
| |
| Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> |
| Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c |
| index 7532b062be59..73044fc6a952 100644 |
| --- a/security/integrity/ima/ima_crypto.c |
| +++ b/security/integrity/ima/ima_crypto.c |
| @@ -271,6 +271,11 @@ static int ima_calc_file_hash_atfm(struct file *file, |
| if (rc != rbuf_len) { |
| if (rc >= 0) |
| rc = -EINVAL; |
| + /* |
| + * Forward current rc, do not overwrite with return value |
| + * from ahash_wait() |
| + */ |
| + ahash_wait(ahash_rc, &wait); |
| goto out3; |
| } |
| |
| -- |
| 2.7.4 |
| |
