path: root/security
diff options
authorMimi Zohar <zohar@linux.vnet.ibm.com>2009-09-04 13:08:46 -0400
committerJames Morris <jmorris@namei.org>2009-09-07 11:54:58 +1000
commitacd0c935178649f72c44ec49ca83bee35ce1f79e (patch)
treec0cb2f8fbbaa54567785b5430e5be8c8b51f5724 /security
parente07cccf4046978df10f2e13fe2b99b2f9b3a65db (diff)
IMA: update ima_counts_put
- As ima_counts_put() may be called after the inode has been freed, verify that the inode is not NULL, before dereferencing it. - Maintain the IMA file counters in may_open() properly, decrementing any counter increments on subsequent errors. Reported-by: Ciprian Docan <docan@eden.rutgers.edu> Reported-by: J.R. Okajima <hooanon05@yahoo.co.jp> Signed-off-by: Mimi Zohar <zohar@us.ibm.com> Acked-by: Eric Paris <eparis@redhat.com Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security')
1 files changed, 5 insertions, 1 deletions
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 4732f5e5d127..b85e61bcf246 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -249,7 +249,11 @@ void ima_counts_put(struct path *path, int mask)
struct inode *inode = path->dentry->d_inode;
struct ima_iint_cache *iint;
- if (!ima_initialized || !S_ISREG(inode->i_mode))
+ /* The inode may already have been freed, freeing the iint
+ * with it. Verify the inode is not NULL before dereferencing
+ * it.
+ */
+ if (!ima_initialized || !inode || !S_ISREG(inode->i_mode))
iint = ima_iint_find_insert_get(inode);
if (!iint)