Re: [PATCH] ima: Fix out-of-bounds read in ima_read_policy()

[sashiko-bot@kernel.org]

> From: Roberto Sassu <roberto.sassu@huawei.com>
> 
> ima_read_policy() reads the policy file with kernel_read_file_from_path()
> and splits it into rules with strsep(). However, the buffer allocated by
> kernel_read_file_from_path() is exactly the size of the file and is not
> NUL-terminated. If the policy file does not end with a newline, strsep()
> scans past the end of the buffer while looking for the next separator. If
> the file size is a multiple of PAGE_SIZE, the scan reaches the vmalloc
> guard page and the kernel oopses.
> 
> If the last byte of the policy is not a newline, parse a NUL-terminated
> copy of the buffer obtained with kmemdup_nul() instead, and account for
> the NUL terminator in the remaining size, since ima_parse_add_rule()
> counts it in the length of the last rule.
> 
> As a side effect, a policy whose last rule is not followed by a newline
> is now loaded, instead of being rejected with -EINVAL due to the
> terminator being counted in the length of the last rule but not in the
> file size.
> 
> Fixes: 7429b092811f ("ima: load policy using path")
> Reported-by: Fabrice Derepas <fabrice.derepas@canonical.com>
> Closes: https://lore.kernel.org/linux-integrity/20260814085443.1211989-1-fabrice.derepas@canonical.com/
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112143029.4159022-1-roberto.sassu@huaweicloud.com?part=1