On Thu, 2022-12-01 at 10:53 -0800, Eric Biggers wrote:
On Thu, Dec 01, 2022 at 11:06:24AM +0100, Roberto Sassu wrote:
From: Roberto Sassu roberto.sassu@huawei.com
Commit ac4e97abce9b8 ("scatterlist: sg_set_buf() argument must be in linear mapping") checks that both the signature and the digest reside in the linear mapping area.
However, more recently commit ba14a194a434c ("fork: Add generic vmalloced stack support"), made it possible to move the stack in the vmalloc area, which is not contiguous, and thus not suitable for sg_set_buf() which needs adjacent pages.
Fix this by checking if CONFIG_VMAP_STACK is enabled. If yes, allocate an evm_digest structure, and use that instead of the in-stack cbounterpart.
Cc: stable@vger.kernel.org # 4.9.x Fixes: ba14a194a434 ("fork: Add generic vmalloced stack support") Signed-off-by: Roberto Sassu roberto.sassu@huawei.com
security/integrity/evm/evm_main.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index 23d484e05e6f..7f76d6103f2e 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -174,6 +174,7 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, struct signature_v2_hdr *hdr; enum integrity_status evm_status = INTEGRITY_PASS; struct evm_digest digest;
- struct evm_digest *digest_ptr = &digest; struct inode *inode; int rc, xattr_len, evm_immutable = 0;
@@ -231,14 +232,26 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, } hdr = (struct signature_v2_hdr *)xattr_data;
digest.hdr.algo = hdr->hash_algo;
if (IS_ENABLED(CONFIG_VMAP_STACK)) {digest_ptr = kmalloc(sizeof(*digest_ptr), GFP_NOFS);if (!digest_ptr) {rc = -ENOMEM;break;}}digest_ptr->hdr.algo = hdr->hash_algo;- rc = evm_calc_hash(dentry, xattr_name, xattr_value,
xattr_value_len, xattr_data->type, &digest);
xattr_value_len, xattr_data->type,digest_ptr);
digest.digest, digest.hdr.length);
digest_ptr->digest,digest_ptr->hdr.length);@@ -268,8 +281,11 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, else evm_status = INTEGRITY_FAIL; }
- pr_debug("digest: (%d) [%*phN]\n", digest.hdr.length, digest.hdr.length,
digest.digest);
- pr_debug("digest: (%d) [%*phN]\n", digest_ptr->hdr.length,
digest_ptr->hdr.length, digest_ptr->digest);- if (digest_ptr && digest_ptr != &digest)
kfree(digest_ptr);What is the actual problem here? Where is a scatterlist being created from this buffer? AFAICS it never happens.
Enabling CONFIG_VMAP_STACK is the culprit, which triggers the BUG_ON only when CONFIG_DEBUG_SG is enabled as well.
Refer to commit ba14a194a434 ("fork: Add generic vmalloced stack support").