From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Krzysztof Struczynski <krzysztof.struczynski@huawei.com>,
Roberto Sassu <roberto.sassu@huawei.com>,
Mimi Zohar <zohar@linux.ibm.com>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.9 06/64] evm: Check also if *tfm is an error pointer in init_desc()
Date: Tue, 26 May 2020 20:52:35 +0200 [thread overview]
Message-ID: <20200526183915.284720219@linuxfoundation.org> (raw)
In-Reply-To: <20200526183913.064413230@linuxfoundation.org>
From: Roberto Sassu <roberto.sassu@huawei.com>
[ Upstream commit 53de3b080d5eae31d0de219617155dcc34e7d698 ]
This patch avoids a kernel panic due to accessing an error pointer set by
crypto_alloc_shash(). It occurs especially when there are many files that
require an unsupported algorithm, as it would increase the likelihood of
the following race condition:
Task A: *tfm = crypto_alloc_shash() <= error pointer
Task B: if (*tfm == NULL) <= *tfm is not NULL, use it
Task B: rc = crypto_shash_init(desc) <= panic
Task A: *tfm = NULL
This patch uses the IS_ERR_OR_NULL macro to determine whether or not a new
crypto context must be created.
Cc: stable@vger.kernel.org
Fixes: d46eb3699502b ("evm: crypto hash replaced by shash")
Co-developed-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com>
Signed-off-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com>
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/integrity/evm/evm_crypto.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index c783fefa558a..e034dc21421e 100644
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -90,7 +90,7 @@ static struct shash_desc *init_desc(char type)
algo = evm_hash;
}
- if (*tfm == NULL) {
+ if (IS_ERR_OR_NULL(*tfm)) {
mutex_lock(&mutex);
if (*tfm)
goto out;
--
2.25.1
next prev parent reply other threads:[~2020-05-26 18:58 UTC|newest]
Thread overview: 69+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-26 18:52 [PATCH 4.9 00/64] 4.9.225-rc1 review Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 01/64] igb: use igb_adapter->io_addr instead of e1000_hw->hw_addr Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 02/64] padata: Remove unused but set variables Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 03/64] padata: get_next is never NULL Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 04/64] padata: ensure the reorder timer callback runs on the correct CPU Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 05/64] padata: ensure padata_do_serial() " Greg Kroah-Hartman
2020-05-26 18:52 ` Greg Kroah-Hartman [this message]
2020-05-26 18:52 ` [PATCH 4.9 07/64] ima: Fix return value of ima_write_policy() Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 08/64] fix multiplication overflow in copy_fdtable() Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 09/64] iommu/amd: Fix over-read of ACPI UID from IVRS table Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 10/64] i2c: mux: demux-pinctrl: Fix an error handling path in i2c_demux_pinctrl_probe() Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 11/64] gcc-common.h: Update for GCC 10 Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 12/64] HID: multitouch: add eGalaxTouch P80H84 support Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 13/64] configfs: fix config_item refcnt leak in configfs_rmdir() Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 14/64] component: Silence bind error on -EPROBE_DEFER Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 15/64] gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp() Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 16/64] ceph: fix double unlock in handle_cap_export() Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 17/64] USB: core: Fix misleading driver bug report Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 18/64] platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 19/64] ARM: futex: Address build warning Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 20/64] i2c: dev: Fix the race between the release of i2c_dev and cdev Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 21/64] padata: set cpu_index of unused CPUs to -1 Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 22/64] padata: Replace delayed timer with immediate workqueue in padata_reorder Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 23/64] padata: initialize pd->cpu with effective cpumask Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 24/64] padata: purge get_cpu and reorder_via_wq from padata_do_serial Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 25/64] arm64: fix the flush_icache_range arguments in machine_kexec Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 26/64] watchdog: Fix the race between the release of watchdog_core_data and cdev Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 27/64] net: l2tp: export debug flags to UAPI Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 28/64] net: l2tp: deprecate PPPOL2TP_MSG_* in favour of L2TP_MSG_* Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 29/64] net: l2tp: ppp: change PPPOL2TP_MSG_* => L2TP_MSG_* Greg Kroah-Hartman
2020-05-26 18:52 ` [PATCH 4.9 30/64] New kernel function to get IP overhead on a socket Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 31/64] L2TP:Adjust intf MTU, add underlay L3, L2 hdrs Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 32/64] l2tp: remove useless duplicate session detection in l2tp_netlink Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 33/64] l2tp: remove l2tp_session_find() Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 34/64] l2tp: define parameters of l2tp_session_get*() as "const" Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 35/64] l2tp: define parameters of l2tp_tunnel_find*() " Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 36/64] l2tp: initialise sessions refcount before making it reachable Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 37/64] l2tp: hold tunnel while looking up sessions in l2tp_netlink Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 38/64] l2tp: hold tunnel while processing genl delete command Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 39/64] l2tp: hold tunnel while handling genl tunnel updates Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 40/64] l2tp: hold tunnel while handling genl TUNNEL_GET commands Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 41/64] l2tp: hold tunnel used while creating sessions with netlink Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 42/64] l2tp: prevent creation of sessions on terminated tunnels Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 43/64] l2tp: pass tunnel pointer to ->session_create() Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 44/64] l2tp: fix l2tp_eth module loading Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 45/64] l2tp: dont register sessions in l2tp_session_create() Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 46/64] l2tp: initialise l2tp_eth sessions before registering them Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 47/64] l2tp: protect sock pointer of struct pppol2tp_session with RCU Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 48/64] l2tp: initialise PPP sessions before registering them Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 49/64] ALSA: pcm: fix incorrect hw_base increase Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 50/64] dmaengine: tegra210-adma: Fix an error handling path in tegra_adma_probe() Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 51/64] l2tp: device MTU setup, tunnel socket needs a lock Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 52/64] x86/uaccess, ubsan: Fix UBSAN vs. SMAP Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 53/64] ubsan: build ubsan.c more conservatively Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 54/64] platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 55/64] libnvdimm/btt: Remove unnecessary code in btt_freelist_init Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 56/64] cxgb4: free mac_hlist properly Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 57/64] cxgb4/cxgb4vf: Fix mac_hlist initialization and free Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 58/64] Revert "gfs2: Dont demote a glock until its revokes are written" Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 59/64] staging: iio: ad2s1210: Fix SPI reading Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 60/64] staging: greybus: Fix uninitialized scalar variable Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 61/64] iio: dac: vf610: Fix an error handling path in vf610_dac_probe() Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 62/64] mei: release me_cl object reference Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 63/64] rapidio: fix an error in get_user_pages_fast() error handling Greg Kroah-Hartman
2020-05-26 18:53 ` [PATCH 4.9 64/64] iio: sca3000: Remove an erroneous get_device() Greg Kroah-Hartman
2020-05-27 8:32 ` [PATCH 4.9 00/64] 4.9.225-rc1 review Jon Hunter
2020-05-27 8:49 ` Naresh Kamboju
2020-05-27 13:51 ` Guenter Roeck
2020-05-27 16:53 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200526183915.284720219@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=krzysztof.struczynski@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=roberto.sassu@huawei.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).