github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

dm-integrity: fix the 'fix_hmac' option

Browse Source 
When the "fix_hmac" argument is used, dm-integrity is supposed to check
the superblock with the journal_mac. However, there was a logic bug in
the code - the code only checked the superblock mac if the bit
SB_FLAG_FIXED_HMAC was set in the superblock. So, the attacker could
clear this bit and bypass the checking trivially.

This commit changes dm-integrity so that when the user specified the
"fix_hmac" flag and the superblock doesn't have the bit
SB_FLAG_FIXED_HMAC set, the activation is aborted with an error.

Unfortunatelly, there's a bug in the integritysetup tool that when using
the 'open' command it passes the "fix_hmac" argument to the kernel even
if the user specified --integrity-legacy-hmac. The bug will be fixed in
the upcoming 2.8.7 release.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reported-by: Shukai Ni <shukai.ni@kuleuven.be>
This commit is contained in:
Mikulas Patocka 2026-07-10 14:31:25 +02:00
parent 8d4dd2db7f
commit 24d7e5e39b
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/md/dm-integrity.c
View File

@ -5130,6 +5130,20 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv
ti->error = "Journal mac mismatch";
goto bad;
}
if (ic->fix_hmac && !(ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_HMAC)) && ic->journal_mac_alg.key_string) {
/*
* If this happens, it may be either because someone tampered
* with the device or it may be due to a bug in the
* integritysetup tool.
*
* In the latter case, upgrade to integritysetup 2.8.7 and use
* the argument --integrity-legacy-hmac when using the open
* command.
*/
r = -EINVAL;
ti->error = "fix_hmac is on the command line but not in the superblock";
goto bad;
}
get_provided_data_sectors(ic);
if (!ic->provided_data_sectors) {