Commit f9ba5375 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'ima-memory-use-fixes' 

* ima-memory-use-fixes:
  IMA: fix the ToMToU logic
  IMA: explicit IMA i_flag to remove global lock on inode_delete
  IMA: drop refcnt from ima_iint_cache since it isn't needed
  IMA: only allocate iint when needed
  IMA: move read counter into struct inode
  IMA: use i_writecount rather than a private counter
  IMA: use inode->i_lock to protect read and write counters
  IMA: convert internal flags from long to char
  IMA: use unsigned int instead of long for counters
  IMA: drop the inode opencount since it isn't needed for operation
  IMA: use rbtree instead of radix tree for inode information cache
parents 45352bbf bade72d6

fs/inode.c

+1 −0
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@ 
#include <linux/mount.h>

#include <linux/async.h>

#include <linux/posix_acl.h>

#include <linux/ima.h>



/*

 * This is needed for the following functions:

include/linux/fs.h

+6 −0
Original line number Diff line number Diff line
@@ -231,6 +231,7 @@ struct inodes_stat_t { 
#define S_NOCMTIME	128	/* Do not update file c/mtime */

#define S_SWAPFILE	256	/* Do not truncate: swapon got its bmaps */

#define S_PRIVATE	512	/* Inode is fs-internal */

#define S_IMA		1024	/* Inode has an associated IMA struct */



/*

 * Note that nosuid etc flags are inode-specific: setting some file-system
@@ -265,6 +266,7 @@ struct inodes_stat_t { 
#define IS_NOCMTIME(inode)	((inode)->i_flags & S_NOCMTIME)

#define IS_SWAPFILE(inode)	((inode)->i_flags & S_SWAPFILE)

#define IS_PRIVATE(inode)	((inode)->i_flags & S_PRIVATE)

#define IS_IMA(inode)		((inode)->i_flags & S_IMA)



/* the read-only stuff doesn't really belong here, but any other place is

   probably as bad and I don't want to create yet another include file. */
@@ -772,6 +774,10 @@ struct inode { 


	unsigned int		i_flags;



#ifdef CONFIG_IMA

	/* protected by i_lock */

	unsigned int		i_readcount; /* struct files open RO */

#endif

	atomic_t		i_writecount;

#ifdef CONFIG_SECURITY

	void			*i_security;

security/integrity/ima/ima.h

+7 −11
Original line number Diff line number Diff line
@@ -70,6 +70,7 @@ int ima_init(void); 
void ima_cleanup(void);

int ima_fs_init(void);

void ima_fs_cleanup(void);

int ima_inode_alloc(struct inode *inode);

int ima_add_template_entry(struct ima_template_entry *entry, int violation,

			   const char *op, struct inode *inode);

int ima_calc_hash(struct file *file, char *digest);
@@ -96,19 +97,16 @@ static inline unsigned long ima_hash_key(u8 *digest) 
}



/* iint cache flags */

#define IMA_MEASURED		1

#define IMA_MEASURED		0x01



/* integrity data associated with an inode */

struct ima_iint_cache {

	struct rb_node rb_node; /* rooted in ima_iint_tree */

	struct inode *inode;	/* back pointer to inode in question */

	u64 version;		/* track inode changes */

	unsigned long flags;

	unsigned char flags;

	u8 digest[IMA_DIGEST_SIZE];

	struct mutex mutex;	/* protects: version, flags, digest */

	long readcount;		/* measured files readcount */

	long writecount;	/* measured files writecount */

	long opencount;		/* opens reference count */

	struct kref refcount;	/* ima_iint_cache reference count */

	struct rcu_head rcu;

};



/* LIM API function definitions */
@@ -122,13 +120,11 @@ int ima_store_template(struct ima_template_entry *entry, int violation, 
void ima_template_show(struct seq_file *m, void *e,

		       enum ima_show_type show);



/* radix tree calls to lookup, insert, delete

/* rbtree tree calls to lookup, insert, delete

 * integrity data associated with an inode.

 */

struct ima_iint_cache *ima_iint_insert(struct inode *inode);

struct ima_iint_cache *ima_iint_find_get(struct inode *inode);

void iint_free(struct kref *kref);

void iint_rcu_free(struct rcu_head *rcu);

struct ima_iint_cache *ima_iint_find(struct inode *inode);



/* IMA policy related functions */

enum ima_hooks { FILE_CHECK = 1, FILE_MMAP, BPRM_CHECK };

security/integrity/ima/ima_api.c

+1 −1
Original line number Diff line number Diff line
@@ -116,7 +116,7 @@ int ima_must_measure(struct ima_iint_cache *iint, struct inode *inode, 
{

	int must_measure;



	if (iint->flags & IMA_MEASURED)

	if (iint && iint->flags & IMA_MEASURED)

		return 1;



	must_measure = ima_match_policy(inode, function, mask);

security/integrity/ima/ima_iint.c

+92 −66
Original line number Diff line number Diff line
@@ -12,98 +12,119 @@ 
 * File: ima_iint.c

 * 	- implements the IMA hooks: ima_inode_alloc, ima_inode_free

 *	- cache integrity information associated with an inode

 *	  using a radix tree.

 *	  using a rbtree tree.

 */

#include <linux/slab.h>

#include <linux/module.h>

#include <linux/spinlock.h>

#include <linux/radix-tree.h>

#include <linux/rbtree.h>

#include "ima.h"



RADIX_TREE(ima_iint_store, GFP_ATOMIC);

DEFINE_SPINLOCK(ima_iint_lock);

static struct rb_root ima_iint_tree = RB_ROOT;

static DEFINE_SPINLOCK(ima_iint_lock);

static struct kmem_cache *iint_cache __read_mostly;



int iint_initialized = 0;



/* ima_iint_find_get - return the iint associated with an inode

 *

 * ima_iint_find_get gets a reference to the iint. Caller must

 * remember to put the iint reference.

/*

 * __ima_iint_find - return the iint associated with an inode

 */

struct ima_iint_cache *ima_iint_find_get(struct inode *inode)

static struct ima_iint_cache *__ima_iint_find(struct inode *inode)

{

	struct ima_iint_cache *iint;

	struct rb_node *n = ima_iint_tree.rb_node;



	assert_spin_locked(&ima_iint_lock);



	while (n) {

		iint = rb_entry(n, struct ima_iint_cache, rb_node);



		if (inode < iint->inode)

			n = n->rb_left;

		else if (inode > iint->inode)

			n = n->rb_right;

		else

			break;

	}

	if (!n)

		return NULL;



	rcu_read_lock();

	iint = radix_tree_lookup(&ima_iint_store, (unsigned long)inode);

	if (!iint)

		goto out;

	kref_get(&iint->refcount);

out:

	rcu_read_unlock();

	return iint;

}



/**

 * ima_inode_alloc - allocate an iint associated with an inode

 * @inode: pointer to the inode

/*

 * ima_iint_find - return the iint associated with an inode

 */

int ima_inode_alloc(struct inode *inode)

struct ima_iint_cache *ima_iint_find(struct inode *inode)

{

	struct ima_iint_cache *iint = NULL;

	int rc = 0;



	iint = kmem_cache_alloc(iint_cache, GFP_NOFS);

	if (!iint)

		return -ENOMEM;

	struct ima_iint_cache *iint;



	rc = radix_tree_preload(GFP_NOFS);

	if (rc < 0)

		goto out;

	if (!IS_IMA(inode))

		return NULL;



	spin_lock(&ima_iint_lock);

	rc = radix_tree_insert(&ima_iint_store, (unsigned long)inode, iint);

	iint = __ima_iint_find(inode);

	spin_unlock(&ima_iint_lock);

	radix_tree_preload_end();

out:

	if (rc < 0)

		kmem_cache_free(iint_cache, iint);



	return rc;

	return iint;

}



/* iint_free - called when the iint refcount goes to zero */

void iint_free(struct kref *kref)

static void iint_free(struct ima_iint_cache *iint)

{

	struct ima_iint_cache *iint = container_of(kref, struct ima_iint_cache,

						   refcount);

	iint->version = 0;

	iint->flags = 0UL;

	if (iint->readcount != 0) {

		printk(KERN_INFO "%s: readcount: %ld\n", __func__,

		       iint->readcount);

		iint->readcount = 0;

	}

	if (iint->writecount != 0) {

		printk(KERN_INFO "%s: writecount: %ld\n", __func__,

		       iint->writecount);

		iint->writecount = 0;

	}

	if (iint->opencount != 0) {

		printk(KERN_INFO "%s: opencount: %ld\n", __func__,

		       iint->opencount);

		iint->opencount = 0;

	}

	kref_init(&iint->refcount);

	kmem_cache_free(iint_cache, iint);

}



void iint_rcu_free(struct rcu_head *rcu_head)

/**

 * ima_inode_alloc - allocate an iint associated with an inode

 * @inode: pointer to the inode

 */

int ima_inode_alloc(struct inode *inode)

{

	struct ima_iint_cache *iint = container_of(rcu_head,

						   struct ima_iint_cache, rcu);

	kref_put(&iint->refcount, iint_free);

	struct rb_node **p;

	struct rb_node *new_node, *parent = NULL;

	struct ima_iint_cache *new_iint, *test_iint;

	int rc;



	new_iint = kmem_cache_alloc(iint_cache, GFP_NOFS);

	if (!new_iint)

		return -ENOMEM;



	new_iint->inode = inode;

	new_node = &new_iint->rb_node;



	mutex_lock(&inode->i_mutex); /* i_flags */

	spin_lock(&ima_iint_lock);



	p = &ima_iint_tree.rb_node;

	while (*p) {

		parent = *p;

		test_iint = rb_entry(parent, struct ima_iint_cache, rb_node);



		rc = -EEXIST;

		if (inode < test_iint->inode)

			p = &(*p)->rb_left;

		else if (inode > test_iint->inode)

			p = &(*p)->rb_right;

		else

			goto out_err;

	}



	inode->i_flags |= S_IMA;

	rb_link_node(new_node, parent, p);

	rb_insert_color(new_node, &ima_iint_tree);



	spin_unlock(&ima_iint_lock);

	mutex_unlock(&inode->i_mutex); /* i_flags */



	return 0;

out_err:

	spin_unlock(&ima_iint_lock);

	mutex_unlock(&inode->i_mutex); /* i_flags */

	iint_free(new_iint);



	return rc;

}



/**
@@ -116,11 +137,20 @@ void ima_inode_free(struct inode *inode) 
{

	struct ima_iint_cache *iint;



	if (inode->i_readcount)

		printk(KERN_INFO "%s: readcount: %u\n", __func__, inode->i_readcount);



	inode->i_readcount = 0;



	if (!IS_IMA(inode))

		return;



	spin_lock(&ima_iint_lock);

	iint = radix_tree_delete(&ima_iint_store, (unsigned long)inode);

	iint = __ima_iint_find(inode);

	rb_erase(&iint->rb_node, &ima_iint_tree);

	spin_unlock(&ima_iint_lock);

	if (iint)

		call_rcu(&iint->rcu, iint_rcu_free);



	iint_free(iint);

}



static void init_once(void *foo)
@@ -131,10 +161,6 @@ static void init_once(void *foo) 
	iint->version = 0;

	iint->flags = 0UL;

	mutex_init(&iint->mutex);

	iint->readcount = 0;

	iint->writecount = 0;

	iint->opencount = 0;

	kref_init(&iint->refcount);

}



static int __init ima_iintcache_init(void)

CRA Git | Maintained and supported by SUSTech CRA and CCSE