Daniel Hodges d592338c23 ima: check return value of crypto_shash_final() in boot aggregate ...

[ Upstream commit 870819434c ]

The return value of crypto_shash_final() is not checked in
ima_calc_boot_aggregate_tfm(). If the hash finalization fails, the
function returns success and a corrupted boot aggregate digest could
be used for IMA measurements.

Capture the return value and propagate any error to the caller.

Fixes: 76bb28f612 ("ima: use new crypto_shash API instead of old crypto_hash")
Signed-off-by: Daniel Hodges <hodgesd@meta.com>
Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-06-01 17:29:35 +02:00

..

evm

…

ima

ima: check return value of crypto_shash_final() in boot aggregate

2026-06-01 17:29:35 +02:00

platform_certs

…

digsig_asymmetric.c

…

digsig.c

…

iint.c

ima: annotate iint mutex to avoid lockdep false positive warnings

2023-12-08 08:46:15 +01:00

integrity_audit.c

…

integrity.h

ima: detect changes to the backing overlay file

2023-11-28 16:54:57 +00:00

Kconfig

…

Makefile

…