]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
Revert "evm: Fix memleak in init_desc"
authorXiu Jianfeng <xiujianfeng@huawei.com>
Fri, 27 May 2022 11:17:26 +0000 (19:17 +0800)
committerStefan Bader <stefan.bader@canonical.com>
Fri, 16 Sep 2022 08:52:36 +0000 (10:52 +0200)
commit0b27c87238234077181746f4e6d28bb1795c1d7e
treefbedde6d3ffc1f8a5a3d33c07e39db7e06cb8743
parent554d201971550e37cbf6cc673ea336530869c687
Revert "evm: Fix memleak in init_desc"

BugLink: https://bugs.launchpad.net/bugs/1988351
commit 51dd64bb99e4478fc5280171acd8e1b529eadaf7 upstream.

This reverts commit ccf11dbaa07b328fa469415c362d33459c140a37.

Commit ccf11dbaa07b ("evm: Fix memleak in init_desc") said there is
memleak in init_desc. That may be incorrect, as we can see, tmp_tfm is
saved in one of the two global variables hmac_tfm or evm_tfm[hash_algo],
then if init_desc is called next time, there is no need to alloc tfm
again, so in the error path of kmalloc desc or crypto_shash_init(desc),
It is not a problem without freeing tmp_tfm.

And also that commit did not reset the global variable to NULL after
freeing tmp_tfm and this makes *tfm a dangling pointer which may cause a
UAF issue.

Reported-by: Guozihua (Scott) <guozihua@huawei.com>
Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
security/integrity/evm/evm_crypto.c