Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7b7e5916 authored by Roberto Sassu's avatar Roberto Sassu Committed by Mimi Zohar
Browse files

ima: fix invalid memory reference 



Don't free a valid measurement entry on TPM PCR extend failure.

Signed-off-by: default avatarRoberto Sassu <roberto.sassu@polito.it>
Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
Cc: stable@vger.kernel.org
parent 45fae749

security/integrity/ima/ima_queue.c

+11 −5
Original line number Diff line number Diff line
@@ -23,6 +23,8 @@ 
#include <linux/slab.h>

#include "ima.h"



#define AUDIT_CAUSE_LEN_MAX 32



LIST_HEAD(ima_measurements);	/* list of all measurements */



/* key: inode (before secure-hashing a file) */
@@ -94,7 +96,8 @@ static int ima_pcr_extend(const u8 *hash) 


	result = tpm_pcr_extend(TPM_ANY_NUM, CONFIG_IMA_MEASURE_PCR_IDX, hash);

	if (result != 0)

		pr_err("IMA: Error Communicating to TPM chip\n");

		pr_err("IMA: Error Communicating to TPM chip, result: %d\n",

		       result);

	return result;

}
@@ -106,8 +109,9 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation, 
{

	u8 digest[IMA_DIGEST_SIZE];

	const char *audit_cause = "hash_added";

	char tpm_audit_cause[AUDIT_CAUSE_LEN_MAX];

	int audit_info = 1;

	int result = 0;

	int result = 0, tpmresult = 0;



	mutex_lock(&ima_extend_list_mutex);

	if (!violation) {
@@ -129,9 +133,11 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation, 
	if (violation)		/* invalidate pcr */

		memset(digest, 0xff, sizeof digest);



	result = ima_pcr_extend(digest);

	if (result != 0) {

		audit_cause = "TPM error";

	tpmresult = ima_pcr_extend(digest);

	if (tpmresult != 0) {

		snprintf(tpm_audit_cause, AUDIT_CAUSE_LEN_MAX, "TPM_error(%d)",

			 tpmresult);

		audit_cause = tpm_audit_cause;

		audit_info = 0;

	}

out: