Skip to contentSkip to conversation

Patch "ima: use file_dentry()" has been added to the 4.8-stable tree

PATCH [email protected] 1 participant 1 message Oct 14, 2016

Subsystems (4)
Stable branch Security (LSM) Integrity measurement architecture (IMA) Extended Verification Module (EVM)
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

ima: use file_dentry()

to the 4.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ima-use-file_dentry.patch
and it can be found in the queue-4.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From e71b9dff0634edb127f449e076e883ef24a8c76c Mon Sep 17 00:00:00 2001

From: Miklos Szeredi <[email protected]>
Date: Fri, 16 Sep 2016 12:44:20 +0200
Subject: ima: use file_dentry()

From: Miklos Szeredi <[email protected]>

commit e71b9dff0634edb127f449e076e883ef24a8c76c upstream.

Ima tries to call ->setxattr() on overlayfs dentry after having locked underlying inode, which results in a deadlock.

Reported-by Krisztian Litkey <[email protected]>
Fixes 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay")
Signed-off-by Miklos Szeredi <[email protected]>
Cc Mimi Zohar <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 security/integrity/ima/ima_appraise.c |    4 ++--
 security/integrity/ima/ima_main.c     |    2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
security/integrity/ima/ima_appraise.c +2 -2
@@ -190,7 +190,7 @@ int ima_appraise_measurement(enum ima_ho
 {
 	static const char op[] = "appraise_data";
 	char *cause = "unknown";
-	struct dentry *dentry = file->f_path.dentry;
+	struct dentry *dentry = file_dentry(file);
 	struct inode *inode = d_backing_inode(dentry);
 	enum integrity_status status = INTEGRITY_UNKNOWN;
 	int rc = xattr_len, hash_start = 0;

@@ -295,7 +295,7 @@ out:
  */
 void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file)
 {
-	struct dentry *dentry = file->f_path.dentry;
+	struct dentry *dentry = file_dentry(file);
 	int rc = 0;
 
 	/* do not collect and update hash for digital signatures */
security/integrity/ima/ima_main.c +1 -1
@@ -228,7 +228,7 @@ static int process_measurement(struct fi
 	if ((action & IMA_APPRAISE_SUBMASK) ||
 		    strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) != 0)
 		/* read 'security.ima' */
-		xattr_len = ima_read_xattr(file->f_path.dentry, &xattr_value);
+		xattr_len = ima_read_xattr(file_dentry(file), &xattr_value);
 
 	hash_algo = ima_get_hash_algo(xattr_value, xattr_len);

Patches currently in stable-queue which might be from [email protected] are

queue-4.8/ima-use-file_dentry.patch