From patchwork Tue May 30 12:14:53 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "tianjia.zhang" X-Patchwork-Id: 13259850 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B45D9C77B7A for ; Tue, 30 May 2023 12:15:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231612AbjE3MPG (ORCPT ); Tue, 30 May 2023 08:15:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45090 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231735AbjE3MPE (ORCPT ); Tue, 30 May 2023 08:15:04 -0400 Received: from out30-98.freemail.mail.aliyun.com (out30-98.freemail.mail.aliyun.com [115.124.30.98]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3CADDC5; Tue, 30 May 2023 05:15:01 -0700 (PDT) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R481e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018046059;MF=tianjia.zhang@linux.alibaba.com;NM=1;PH=DS;RN=9;SR=0;TI=SMTPD_---0Vjtf.r0_1685448895; Received: from localhost(mailfrom:tianjia.zhang@linux.alibaba.com fp:SMTPD_---0Vjtf.r0_1685448895) by smtp.aliyun-inc.com; Tue, 30 May 2023 20:14:56 +0800 From: Tianjia Zhang To: Mimi Zohar , Dmitry Kasatkin , Paul Moore , James Morris , "Serge E. Hallyn" , linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Tianjia Zhang Subject: [PATCH] integrity: Fix possible multiple allocation in integrity_inode_get() Date: Tue, 30 May 2023 20:14:53 +0800 Message-Id: <20230530121453.10249-1-tianjia.zhang@linux.alibaba.com> X-Mailer: git-send-email 2.24.3 (Apple Git-128) MIME-Version: 1.0 Precedence: bulk List-ID: When integrity_inode_get() is querying and inserting the cache, there is a conditional race in the concurrent environment. Query iint within the read-lock. If there is no result, allocate iint first and insert the iint cache in the write-lock protection. When the iint cache does not exist, and when multiple execution streams come at the same time, there will be a race condition, and multiple copies of iint will be allocated at the same time, and then put into the cache one by one under the write-lock protection. This is mainly because the red-black tree insertion does not perform duplicate detection. This is not the desired result, when this happens, the repeated allocation should be freed and the existing iint cache should be returned. Fixes: bf2276d10ce5 ("ima: allocating iint improvements") Signed-off-by: Tianjia Zhang Cc: Dmitry Kasatkin Cc: # v3.10+ --- security/integrity/iint.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/security/integrity/iint.c b/security/integrity/iint.c index c73858e8c6d5..d49c843a88ee 100644 --- a/security/integrity/iint.c +++ b/security/integrity/iint.c @@ -43,12 +43,10 @@ static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode) else if (inode > iint->inode) n = n->rb_right; else - break; + return iint; } - if (!n) - return NULL; - return iint; + return NULL; } /* @@ -115,8 +113,13 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode) rb_node); if (inode < test_iint->inode) p = &(*p)->rb_left; - else + else if (inode > test_iint->inode) p = &(*p)->rb_right; + else { + write_unlock(&integrity_iint_lock); + kmem_cache_free(iint_cache, iint); + return test_iint; + } } iint->inode = inode;