Commit 8dd4711b authored by Xiu Jianfeng's avatar Xiu Jianfeng Committed by Zheng Zengkai
Browse files

Revert "evm: Fix memleak in init_desc"

stable inclusion
from stable-v5.10.132
commit 9d883b3f000d405d19b3484e3d8d97796e6854c6
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I5YS3T

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9d883b3f000d405d19b3484e3d8d97796e6854c6



--------------------------------

commit 51dd64bb upstream.

This reverts commit ccf11dba.

Commit ccf11dba ("evm: Fix memleak in init_desc") said there is
memleak in init_desc. That may be incorrect, as we can see, tmp_tfm is
saved in one of the two global variables hmac_tfm or evm_tfm[hash_algo],
then if init_desc is called next time, there is no need to alloc tfm
again, so in the error path of kmalloc desc or crypto_shash_init(desc),
It is not a problem without freeing tmp_tfm.

And also that commit did not reset the global variable to NULL after
freeing tmp_tfm and this makes *tfm a dangling pointer which may cause a
UAF issue.

Reported-by: default avatarGuozihua (Scott) <guozihua@huawei.com>
Signed-off-by: default avatarXiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>

 Conflicts:
	security/integrity/evm/evm_crypto.c

Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
Acked-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
parent f128bebf
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment