Commit aa662fc0 authored by KP Singh's avatar KP Singh Committed by Mimi Zohar

ima: Fix NULL pointer dereference in ima_file_hash

ima_file_hash can be called when there is no iint->ima_hash available
even though the inode exists in the integrity cache. It is fairly
common for a file to not have a hash. (e.g. an mknodat, prior to the
file being closed).

Another example where this can happen (suggested by Jann Horn):

Process A does:

	while(1) {
		unlink("/tmp/imafoo");
		fd = open("/tmp/imafoo", O_RDWR|O_CREAT|O_TRUNC, 0700);
		if (fd == -1) {
			perror("open");
			continue;
		}
		write(fd, "A", 1);
		close(fd);
	}

and Process B does:

	while (1) {
		int fd = open("/tmp/imafoo", O_RDONLY);
		if (fd == -1)
			continue;
    		char *mapping = mmap(NULL, 0x1000, PROT_READ|PROT_EXEC,
			 	     MAP_PRIVATE, fd, 0);
		if (mapping != MAP_FAILED)
			munmap(mapping, 0x1000);
		close(fd);
  	}

Due to the race to get the iint->mutex between ima_file_hash and
process_measurement iint->ima_hash could still be NULL.

Fixes: 6beea7af ("ima: add the ability to query the cached hash of a given file")
Signed-off-by: default avatarKP Singh <kpsingh@google.com>
Reviewed-by: default avatarFlorent Revest <revest@chromium.org>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent 455b6c91
...@@ -536,6 +536,16 @@ int ima_file_hash(struct file *file, char *buf, size_t buf_size) ...@@ -536,6 +536,16 @@ int ima_file_hash(struct file *file, char *buf, size_t buf_size)
return -EOPNOTSUPP; return -EOPNOTSUPP;
mutex_lock(&iint->mutex); mutex_lock(&iint->mutex);
/*
* ima_file_hash can be called when ima_collect_measurement has still
* not been called, we might not always have a hash.
*/
if (!iint->ima_hash) {
mutex_unlock(&iint->mutex);
return -EOPNOTSUPP;
}
if (buf) { if (buf) {
size_t copied_size; size_t copied_size;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment