| Message ID | 20221112092719.224888-1-xiujianfeng@huawei.com (mailing list archive) |
|---|---|
| State | Handled Elsewhere |
| Headers | show |
| Series | ima: Fix misuse of dereference of pointer in template_desc_init_fields() | expand |
> From: Xiujianfeng > Sent: Saturday, November 12, 2022 10:27 AM > The input parameter @fields is type of struct ima_template_field ***, so > when allocates array memory for @fields, the size of element should be > sizeof(**field) instead of sizeof(*field). > > Actually the original code would not cause any runtime error, but it's > better to make it logically right. > > Fixes: adf53a778a0a ("ima: new templates management mechanism") > Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com> Thanks Roberto > --- > security/integrity/ima/ima_template.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/security/integrity/ima/ima_template.c > b/security/integrity/ima/ima_template.c > index 49f0626928a1..04c49f05cb74 100644 > --- a/security/integrity/ima/ima_template.c > +++ b/security/integrity/ima/ima_template.c > @@ -245,11 +245,11 @@ int template_desc_init_fields(const char > *template_fmt, > } > > if (fields && num_fields) { > - *fields = kmalloc_array(i, sizeof(*fields), GFP_KERNEL); > + *fields = kmalloc_array(i, sizeof(**fields), GFP_KERNEL); > if (*fields == NULL) > return -ENOMEM; > > - memcpy(*fields, found_fields, i * sizeof(*fields)); > + memcpy(*fields, found_fields, i * sizeof(**fields)); > *num_fields = i; > } > > -- > 2.17.1
On Mon, 2022-11-14 at 08:37 +0000, Roberto Sassu wrote: > > From: Xiujianfeng > > Sent: Saturday, November 12, 2022 10:27 AM > > The input parameter @fields is type of struct ima_template_field ***, so > > when allocates array memory for @fields, the size of element should be > > sizeof(**field) instead of sizeof(*field). > > > > Actually the original code would not cause any runtime error, but it's > > better to make it logically right. > > > > Fixes: adf53a778a0a ("ima: new templates management mechanism") > > Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> > > Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com> Thanks, applied. Mimi
diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c index 49f0626928a1..04c49f05cb74 100644 --- a/security/integrity/ima/ima_template.c +++ b/security/integrity/ima/ima_template.c @@ -245,11 +245,11 @@ int template_desc_init_fields(const char *template_fmt, } if (fields && num_fields) { - *fields = kmalloc_array(i, sizeof(*fields), GFP_KERNEL); + *fields = kmalloc_array(i, sizeof(**fields), GFP_KERNEL); if (*fields == NULL) return -ENOMEM; - memcpy(*fields, found_fields, i * sizeof(*fields)); + memcpy(*fields, found_fields, i * sizeof(**fields)); *num_fields = i; }
The input parameter @fields is type of struct ima_template_field ***, so when allocates array memory for @fields, the size of element should be sizeof(**field) instead of sizeof(*field). Actually the original code would not cause any runtime error, but it's better to make it logically right. Fixes: adf53a778a0a ("ima: new templates management mechanism") Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> --- security/integrity/ima/ima_template.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)