Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6427e6c7 authored by Petko Manolov's avatar Petko Manolov Committed by Mimi Zohar
Browse files

ima: ima_write_policy() limit locking 



There is no need to hold the ima_write_mutex for so long.  We only need it
around ima_parse_add_rule().

Changelog:
- The return path now takes into account failed kmalloc() call.

Reported-by: default avatarAl Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: default avatarPetko Manolov <petkan@mip-labs.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
parent 0112721d

security/integrity/ima/ima_fs.c

+9 −9
Original line number Diff line number Diff line
@@ -261,13 +261,8 @@ static const struct file_operations ima_ascii_measurements_ops = { 
static ssize_t ima_write_policy(struct file *file, const char __user *buf,

				size_t datalen, loff_t *ppos)

{

	char *data = NULL;

	char *data;

	ssize_t result;

	int res;



	res = mutex_lock_interruptible(&ima_write_mutex);

	if (res)

		return res;



	if (datalen >= PAGE_SIZE)

		datalen = PAGE_SIZE - 1;
@@ -286,14 +281,19 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf, 


	result = -EFAULT;

	if (copy_from_user(data, buf, datalen))

		goto out;

		goto out_free;



	result = mutex_lock_interruptible(&ima_write_mutex);

	if (result < 0)

		goto out_free;

	result = ima_parse_add_rule(data);

	mutex_unlock(&ima_write_mutex);



out_free:

	kfree(data);

out:

	if (result < 0)

		valid_policy = 0;

	kfree(data);

	mutex_unlock(&ima_write_mutex);



	return result;

}