Commit 31e99fa9 authored May 27, 2022 by Xiu Jianfeng Committed by Greg Kroah-Hartman Jul 21, 2022

Revert "evm: Fix memleak in init_desc"



commit 51dd64bb99e4478fc5280171acd8e1b529eadaf7 upstream.

This reverts commit ccf11dbaa07b328fa469415c362d33459c140a37.

Commit ccf11dbaa07b ("evm: Fix memleak in init_desc") said there is
memleak in init_desc. That may be incorrect, as we can see, tmp_tfm is
saved in one of the two global variables hmac_tfm or evm_tfm[hash_algo],
then if init_desc is called next time, there is no need to alloc tfm
again, so in the error path of kmalloc desc or crypto_shash_init(desc),
It is not a problem without freeing tmp_tfm.

And also that commit did not reset the global variable to NULL after
freeing tmp_tfm and this makes *tfm a dangling pointer which may cause a
UAF issue.

Reported-by: Guozihua (Scott) <guozihua@huawei.com>
Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent d85d19f3

security/integrity/evm/evm_crypto.c

+2 −5

Original line number	Diff line number	Diff line
		@@ -75,7 +75,7 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
		{
		long rc;
		const char *algo;
		struct crypto_shash *tfm, tmp_tfm = NULL;
		struct crypto_shash *tfm, tmp_tfm;
		struct shash_desc *desc;

		if (type == EVM_XATTR_HMAC) {
		@@ -120,16 +120,13 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
		alloc:
		desc = kmalloc(sizeof(desc) + crypto_shash_descsize(tfm),
		GFP_KERNEL);
		if (!desc) {
		crypto_free_shash(tmp_tfm);
		if (!desc)
		return ERR_PTR(-ENOMEM);
		}

		desc->tfm = *tfm;

		rc = crypto_shash_init(desc);
		if (rc) {
		crypto_free_shash(tmp_tfm);
		kfree(desc);
		return ERR_PTR(rc);
		}