ima: always maintain counters

commit 8262bb85da allocated the inode integrity struct (iint) before any
inodes were created. Only after IMA was initialized in late_initcall were
the counters updated. This patch updates the counters, whether or not IMA
has been initialized, to resolve 'imbalance' messages.

This patch fixes the bug as reported in bugzilla: 15673.  When the i915
is builtin, the ring_buffer is initialized before IMA, causing the
imbalance message on suspend.

Reported-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Tested-by: Thomas Meyer <thomas@m3y3r.de>
Tested-by: David Safford<safford@watson.ibm.com>
Cc: Stable Kernel <stable@kernel.org>
Signed-off-by: James Morris <jmorris@namei.org>

1 files changed, 5 insertions, 3 deletions

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index f93641382e9f..e662b89d4079 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -148,12 +148,14 @@ void ima_counts_get(struct file *file)
         struct ima_iint_cache *iint;
         int rc;
 
-        if (!ima_initialized || !S_ISREG(inode->i_mode))
+        if (!iint_initialized || !S_ISREG(inode->i_mode))
                 return;
         iint = ima_iint_find_get(inode);
         if (!iint)
                 return;
         mutex_lock(&iint->mutex);
+        if (!ima_initialized)
+                goto out;
         rc = ima_must_measure(iint, inode, MAY_READ, FILE_CHECK);
         if (rc < 0)
                 goto out;
@@ -213,7 +215,7 @@ void ima_file_free(struct file *file)
         struct inode *inode = file->f_dentry->d_inode;
         struct ima_iint_cache *iint;
 
-        if (!ima_initialized || !S_ISREG(inode->i_mode))
+        if (!iint_initialized || !S_ISREG(inode->i_mode))
                 return;
         iint = ima_iint_find_get(inode);
         if (!iint)
@@ -230,7 +232,7 @@ static int process_measurement(struct file *file, const unsigned char *filename,
 {
         struct inode *inode = file->f_dentry->d_inode;
         struct ima_iint_cache *iint;
-        int rc;
+        int rc = 0;
 
         if (!ima_initialized || !S_ISREG(inode->i_mode))
                 return 0;