diff options
| author | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2009-09-04 19:08:46 +0200 |
|---|---|---|
| committer | James Morris <jmorris@namei.org> | 2009-09-07 03:54:58 +0200 |
| commit | acd0c935178649f72c44ec49ca83bee35ce1f79e (patch) | |
| tree | c0cb2f8fbbaa54567785b5430e5be8c8b51f5724 /security/integrity/ima/ima_main.c | |
| parent | Linux 2.6.31-rc9 (diff) | |
| download | linux-acd0c935178649f72c44ec49ca83bee35ce1f79e.tar.xz linux-acd0c935178649f72c44ec49ca83bee35ce1f79e.zip | |
IMA: update ima_counts_put
- As ima_counts_put() may be called after the inode has been freed,
verify that the inode is not NULL, before dereferencing it.
- Maintain the IMA file counters in may_open() properly, decrementing
any counter increments on subsequent errors.
Reported-by: Ciprian Docan <docan@eden.rutgers.edu>
Reported-by: J.R. Okajima <hooanon05@yahoo.co.jp>
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Acked-by: Eric Paris <eparis@redhat.com
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/integrity/ima/ima_main.c')
| -rw-r--r-- | security/integrity/ima/ima_main.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 4732f5e5d127..b85e61bcf246 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -249,7 +249,11 @@ void ima_counts_put(struct path *path, int mask) struct inode *inode = path->dentry->d_inode; struct ima_iint_cache *iint; - if (!ima_initialized || !S_ISREG(inode->i_mode)) + /* The inode may already have been freed, freeing the iint + * with it. Verify the inode is not NULL before dereferencing + * it. + */ + if (!ima_initialized || !inode || !S_ISREG(inode->i_mode)) return; iint = ima_iint_find_insert_get(inode); if (!iint) |