ima: free duplicate measurement memory

commit 45fae7493970d7c45626ccd96d4a74f5f1eea5a9 upstream.

Info about new measurements are cached in the iint for performance.  When
the inode is flushed from cache, the associated iint is flushed as well.
Subsequent access to the inode will cause the inode to be re-measured and
will attempt to add a duplicate entry to the measurement list.

This patch frees the duplicate measurement memory, fixing a memory leak.

Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index da36d2c085a4ff732967a273fe41423da0ae1b46..5335605571fe41c98014b9de7eb6791eecdc5a2f 100644 (file)
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -177,8 +177,8 @@ void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
        strncpy(entry->template.file_name, filename, IMA_EVENT_NAME_LEN_MAX);
 
        result = ima_store_template(entry, violation, inode);
-       if (!result)
+       if (!result || result == -EEXIST)
                iint->flags |= IMA_MEASURED;
-       else
+       if (result < 0)
                kfree(entry);
 }

diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
index 8e28f04a5e2e8282d2bdd940393fda3a889e77cc..e1a5062b1f6aaf3a9e4496c7a155fff739a76068 100644 (file)
--- a/security/integrity/ima/ima_queue.c
+++ b/security/integrity/ima/ima_queue.c
@@ -114,6 +114,7 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
                memcpy(digest, entry->digest, sizeof digest);
                if (ima_lookup_digest_entry(digest)) {
                        audit_cause = "hash_exists";
+                       result = -EEXIST;
                        goto out;
                }
        }