summaryrefslogtreecommitdiff
path: root/security/integrity/ima
diff options
context:
space:
mode:
authorRoberto Sassu <roberto.sassu@huawei.com>2020-09-04 12:23:28 +0300
committerMimi Zohar <zohar@linux.ibm.com>2020-09-15 20:47:37 +0300
commit60386b854008adc951c470067f90a2d85b5d520f (patch)
tree8feb76eb46156dc4e0c641c0749ad833f3ecabaf /security/integrity/ima
parentf60c826d031817772b634c0cda37794ce6d7946a (diff)
downloadlinux-60386b854008adc951c470067f90a2d85b5d520f.tar.xz
ima: Don't ignore errors from crypto_shash_update()
Errors returned by crypto_shash_update() are not checked in ima_calc_boot_aggregate_tfm() and thus can be overwritten at the next iteration of the loop. This patch adds a check after calling crypto_shash_update() and returns immediately if the result is not zero. Cc: stable@vger.kernel.org Fixes: 3323eec921efd ("integrity: IMA as an integrity service provider") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'security/integrity/ima')
-rw-r--r--security/integrity/ima/ima_crypto.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index 011c3c76af86..21989fa0c107 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -829,6 +829,8 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id,
/* now accumulate with current aggregate */
rc = crypto_shash_update(shash, d.digest,
crypto_shash_digestsize(tfm));
+ if (rc != 0)
+ return rc;
}
/*
* Extend cumulative digest over TPM registers 8-9, which contain