linux-kernel - Re: [PATCH] integrity: add error handling for kmem_cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <1528921830.3282.7.camel@linux.vnet.ibm.com>
Date:   Wed, 13 Jun 2018 16:30:30 -0400
From:   Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:     Zhouyang Jia <jiazhouyang09@...il.com>
Cc:     James Morris <jmorris@...ei.org>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        Matthew Garrett <mjg59@...gle.com>,
        Jeff Layton <jlayton@...hat.com>,
        Thiago Jung Bauermann <bauerman@...ux.vnet.ibm.com>,
        Dmitry Kasatkin <dmitry.kasatkin@...il.com>,
        linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] integrity: add error handling for kmem_cache_create

On Tue, 2018-06-12 at 12:27 +0800, Zhouyang Jia wrote:
> When kmem_cache_create fails, the lack of error-handling code may
> cause unexpected results.
> 
> This patch adds error-handling code after calling kmem_cache_create.

The slab is being create during __init.  Under what circumstances do
you expect the allocation to fail?  Have you tested what happens if it
fails with/without at least an IMA measurement policy?

Mimi
  
> 
> Signed-off-by: Zhouyang Jia <jiazhouyang09@...il.com>
> ---
>  security/integrity/iint.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/security/integrity/iint.c b/security/integrity/iint.c
> index 149faa8..c074fd8 100644
> --- a/security/integrity/iint.c
> +++ b/security/integrity/iint.c
> @@ -172,6 +172,9 @@ static int __init integrity_iintcache_init(void)
>  	iint_cache =
>  	    kmem_cache_create("iint_cache", sizeof(struct integrity_iint_cache),
>  			      0, SLAB_PANIC, init_once);
> +	if (!iint_cache)
> +		return -ENOMEM;
> +
>  	return 0;
>  }
>  security_initcall(integrity_iintcache_init);