diff options
author | Eric Paris <eparis@redhat.com> | 2009-08-26 14:56:48 -0400 |
---|---|---|
committer | James Morris <jmorris@namei.org> | 2009-08-27 11:01:03 +1000 |
commit | 53a7197aff20e341487fca8575275056fe1c63e5 (patch) | |
tree | db302fc811fb6debaa7015abd908c053a59d084f /security/integrity/ima/ima_main.c | |
parent | 3edf2fb9d80a46d6c32ba12547a42419845b4b76 (diff) | |
download | op-kernel-dev-53a7197aff20e341487fca8575275056fe1c63e5.zip op-kernel-dev-53a7197aff20e341487fca8575275056fe1c63e5.tar.gz |
IMA: iint put in ima_counts_get and put
ima_counts_get() calls ima_iint_find_insert_get() which takes a reference
to the iint in question, but does not put that reference at the end of the
function. This can lead to a nasty memory leak. Easy enough to reproduce:
#include <sys/mman.h>
#include <stdio.h>
int main (void)
{
int i;
void *ptr;
for (i=0; i < 100000; i++) {
ptr = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_SHARED|MAP_ANONYMOUS, -1, 0);
if (ptr == MAP_FAILED)
return 2;
munmap(ptr, 4096);
}
return 0;
}
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/integrity/ima/ima_main.c')
-rw-r--r-- | security/integrity/ima/ima_main.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 101c512..4732f5e 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -262,6 +262,8 @@ void ima_counts_put(struct path *path, int mask) else if (mask & (MAY_READ | MAY_EXEC)) iint->readcount--; mutex_unlock(&iint->mutex); + + kref_put(&iint->refcount, iint_free); } /* @@ -291,6 +293,8 @@ void ima_counts_get(struct file *file) if (file->f_mode & FMODE_WRITE) iint->writecount++; mutex_unlock(&iint->mutex); + + kref_put(&iint->refcount, iint_free); } EXPORT_SYMBOL_GPL(ima_counts_get); |