Commit a249a61a authored Jun 01, 2023 by Tianjia Zhang Committed by Greg Kroah-Hartman Jul 27, 2023

integrity: Fix possible multiple allocation in integrity_inode_get()



commit 9df6a4870dc371136e90330cfbbc51464ee66993 upstream.

When integrity_inode_get() is querying and inserting the cache, there
is a conditional race in the concurrent environment.

The race condition is the result of not properly implementing
"double-checked locking". In this case, it first checks to see if the
iint cache record exists before taking the lock, but doesn't check
again after taking the integrity_iint_lock.

Fixes: bf2276d1 ("ima: allocating iint improvements")
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc: <stable@vger.kernel.org> # v3.10+
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 0729029e

security/integrity/iint.c

+9 −6

Original line number	Diff line number	Diff line
		@@ -43,12 +43,10 @@ static struct integrity_iint_cache __integrity_iint_find(struct inode inode)
		else if (inode > iint->inode)
		n = n->rb_right;
		else
		break;
		return iint;
		}
		if (!n)
		return NULL;

		return iint;
		return NULL;
		}

		/*
		@@ -121,10 +119,15 @@ struct integrity_iint_cache integrity_inode_get(struct inode inode)
		parent = *p;
		test_iint = rb_entry(parent, struct integrity_iint_cache,
		rb_node);
		if (inode < test_iint->inode)
		if (inode < test_iint->inode) {
		p = &(*p)->rb_left;
		else
		} else if (inode > test_iint->inode) {
		p = &(*p)->rb_right;
		} else {
		write_unlock(&integrity_iint_lock);
		kmem_cache_free(iint_cache, iint);
		return test_iint;
		}
		}

		iint->inode = inode;