[PATCH v2] ima: Fix a potential integer overflow in ima_appraise_measurement

[PATCH v2] ima: Fix a potential integer overflow in ima_appraise_measurement

[luhuaxin1]

From: Huaxin Lu <luhuaxin1@huawei.com>

When the ima-modsig is enabled, the rc passed to evm_verifyxattr() may be
negative, which may cause the integer overflow problem.

Signed-off-by: Huaxin Lu <luhuaxin1@huawei.com>
---
 security/integrity/ima/ima_appraise.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 3fb378017f9d..956fb0f4c006 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -412,7 +412,8 @@ int ima_appraise_measurement(enum ima_hooks func,
 		goto out;
 	}
 
-	status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint);
+	status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value,
+				 rc < 0 ? 0 : rc, iint);
 	switch (status) {
 	case INTEGRITY_PASS:
 	case INTEGRITY_PASS_IMMUTABLE:
-- 
2.33.0

Re: [PATCH v2] ima: Fix a potential integer overflow in ima_appraise_measurement

[Mimi Zohar]

On Tue, 2022-07-05 at 13:14 +0800, luhuaxin1@huawei.com wrote:
> From: Huaxin Lu <luhuaxin1@huawei.com>
> 
> When the ima-modsig is enabled, the rc passed to evm_verifyxattr() may be
> negative, which may cause the integer overflow problem.
> 
> Signed-off-by: Huaxin Lu <luhuaxin1@huawei.com>

Thanks, Huaxin.  This patch is now queued in next/next-testing.

Mimi