aboutsummaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorEric Paris <eparis@redhat.com>2009-08-26 14:56:48 -0400
committerJames Morris <jmorris@namei.org>2009-08-26 21:01:03 -0400
commit53a7197aff20e341487fca8575275056fe1c63e5 (patch)
treedb302fc811fb6debaa7015abd908c053a59d084f /security
parent3edf2fb9d80a46d6c32ba12547a42419845b4b76 (diff)
IMA: iint put in ima_counts_get and put
ima_counts_get() calls ima_iint_find_insert_get() which takes a reference to the iint in question, but does not put that reference at the end of the function. This can lead to a nasty memory leak. Easy enough to reproduce: #include <sys/mman.h> #include <stdio.h> int main (void) { int i; void *ptr; for (i=0; i < 100000; i++) { ptr = mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANONYMOUS, -1, 0); if (ptr == MAP_FAILED) return 2; munmap(ptr, 4096); } return 0; } Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security')
-rw-r--r--security/integrity/ima/ima_main.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 101c512564ec..4732f5e5d127 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -262,6 +262,8 @@ void ima_counts_put(struct path *path, int mask)
262 else if (mask & (MAY_READ | MAY_EXEC)) 262 else if (mask & (MAY_READ | MAY_EXEC))
263 iint->readcount--; 263 iint->readcount--;
264 mutex_unlock(&iint->mutex); 264 mutex_unlock(&iint->mutex);
265
266 kref_put(&iint->refcount, iint_free);
265} 267}
266 268
267/* 269/*
@@ -291,6 +293,8 @@ void ima_counts_get(struct file *file)
291 if (file->f_mode & FMODE_WRITE) 293 if (file->f_mode & FMODE_WRITE)
292 iint->writecount++; 294 iint->writecount++;
293 mutex_unlock(&iint->mutex); 295 mutex_unlock(&iint->mutex);
296
297 kref_put(&iint->refcount, iint_free);
294} 298}
295EXPORT_SYMBOL_GPL(ima_counts_get); 299EXPORT_SYMBOL_GPL(ima_counts_get);
296 300