From: David Laight <David.Laight@ACULAB.COM>
To: 'Roberto Sassu' <roberto.sassu@huawei.com>,
"zohar@linux.ibm.com" <zohar@linux.ibm.com>,
"rgoldwyn@suse.de" <rgoldwyn@suse.de>
Cc: "linux-integrity@vger.kernel.org"
<linux-integrity@vger.kernel.org>,
"linux-security-module@vger.kernel.org"
<linux-security-module@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Silviu Vlasceanu <Silviu.Vlasceanu@huawei.com>,
Krzysztof Struczynski <krzysztof.struczynski@huawei.com>,
"stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: RE: [PATCH v2 3/6] ima: Fix ima digest hash table key calculation
Date: Mon, 27 Apr 2020 14:28:24 +0000 [thread overview]
Message-ID: <5786ad88cd184e5791bc285d5cac6ecc@AcuMS.aculab.com> (raw)
In-Reply-To: <90e19242fd8445cf93728c0946c03c19@huawei.com>
From: Roberto Sassu
> Sent: 27 April 2020 13:51
...
> > > -static inline unsigned long ima_hash_key(u8 *digest)
> > > +static inline unsigned int ima_hash_key(u8 *digest)
> > > {
> > > - return hash_long(*digest, IMA_HASH_BITS);
> > > + return (*(unsigned int *)digest % IMA_MEASURE_HTABLE_SIZE);
> >
> > That almost certainly isn't right.
> > It falls foul of the *(integer_type *)ptr being almost always wrong.
>
> I didn't find the problem. Can you please explain?
The general problem with *(int_type *)ptr is that it does completely
the wrong thing if 'ptr' is the address of a larger integer type on
a big-endian system.
You may also get a misaligned access trap.
In this case I guess that digest is actually u8[SHA1_DIGEST_SIZE].
Maybe what you should return is:
(digest[0] | digest[1] << 8) % IMA_MEASURE_HTABLE_SIZE;
and comment that there is no point taking a hash of part of
a SHA1 digest.
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
next prev parent reply other threads:[~2020-04-27 14:30 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-27 10:28 [PATCH v2 1/6] ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash() Roberto Sassu
2020-04-27 10:28 ` [PATCH v2 2/6] evm: Check also if *tfm is an error pointer in init_desc() Roberto Sassu
2020-04-27 10:28 ` [PATCH v2 3/6] ima: Fix ima digest hash table key calculation Roberto Sassu
2020-04-27 11:00 ` David Laight
2020-04-27 12:50 ` Roberto Sassu
2020-04-27 14:28 ` David Laight [this message]
2020-04-28 7:19 ` Roberto Sassu
2020-04-28 7:30 ` [RESEND][PATCH " Roberto Sassu
2020-04-30 8:03 ` David Laight
2020-04-27 10:28 ` [PATCH v2 4/6] ima: Remove redundant policy rule set in add_rules() Roberto Sassu
2020-04-27 10:28 ` [PATCH v2 5/6] ima: Set again build_ima_appraise variable Roberto Sassu
2020-04-27 10:31 ` [PATCH v2 6/6] ima: Fix return value of ima_write_policy() Roberto Sassu
2020-04-28 17:46 ` Mimi Zohar
2020-04-29 6:43 ` Krzysztof Struczynski
2020-04-27 13:42 ` [PATCH v2 1/6] ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash() Goldwyn Rodrigues
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5786ad88cd184e5791bc285d5cac6ecc@AcuMS.aculab.com \
--to=david.laight@aculab.com \
--cc=Silviu.Vlasceanu@huawei.com \
--cc=krzysztof.struczynski@huawei.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=rgoldwyn@suse.de \
--cc=roberto.sassu@huawei.com \
--cc=stable@vger.kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).