mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-02 23:27:06 +00:00
integrity: Fix possible multiple allocation in integrity_inode_get()
commit9df6a4870d
upstream. When integrity_inode_get() is querying and inserting the cache, there is a conditional race in the concurrent environment. The race condition is the result of not properly implementing "double-checked locking". In this case, it first checks to see if the iint cache record exists before taking the lock, but doesn't check again after taking the integrity_iint_lock. Fixes:bf2276d10c
("ima: allocating iint improvements") Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com> Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com> Cc: <stable@vger.kernel.org> # v3.10+ Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
9658a03f80
commit
8bf91a8d48
1 changed files with 9 additions and 6 deletions
|
@ -43,12 +43,10 @@ static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode)
|
|||
else if (inode > iint->inode)
|
||||
n = n->rb_right;
|
||||
else
|
||||
break;
|
||||
return iint;
|
||||
}
|
||||
if (!n)
|
||||
return NULL;
|
||||
|
||||
return iint;
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/*
|
||||
|
@ -121,10 +119,15 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode)
|
|||
parent = *p;
|
||||
test_iint = rb_entry(parent, struct integrity_iint_cache,
|
||||
rb_node);
|
||||
if (inode < test_iint->inode)
|
||||
if (inode < test_iint->inode) {
|
||||
p = &(*p)->rb_left;
|
||||
else
|
||||
} else if (inode > test_iint->inode) {
|
||||
p = &(*p)->rb_right;
|
||||
} else {
|
||||
write_unlock(&integrity_iint_lock);
|
||||
kmem_cache_free(iint_cache, iint);
|
||||
return test_iint;
|
||||
}
|
||||
}
|
||||
|
||||
iint->inode = inode;
|
||||
|
|
Loading…
Reference in a new issue