[PATCH] ima: initialize the real inode attributes of the iint cache

[PATCH] ima: initialize the real inode attributes of the iint cache

[Cai Xinchen]

ima_iint_cache objects are allocated with kmem_cache_alloc() from a
dedicated slab whose constructor only runs once, when the slab is first
created; the constructor does not run again when a freed object is
reallocated.  ima_iint_init_always() resets all iint fields except
real_inode.ino and real_inode.dev, which therefore keep the values of
the previously freed iint.

integrity_inode_attrs_changed() reads those fields in
process_measurement() to detect changes to the backing file on stacked
filesystems.  The fields are normally written by
integrity_inode_attrs_store() from ima_collect_measurement(), but the
IMA_HASH path sets IMA_HASHED without calling it, so on the next file
open the stale, uninitialized ino and dev are read.  Depending on the
residual values, IMA may skip re-evaluating a file whose backing data
or metadata changed, or needlessly re-evaluate it.

Initialize real_inode.ino and real_inode.dev with the identification
of the inode the iint is being associated with at allocation time.
On stacked filesystems the first comparison against the underlying
real inode will then fail until ima_collect_measurement() stores the
real inode's attributes, which is the safe, conservative direction.

Fixes: b836c4d29f27 ("ima: detect changes to the backing overlay file")
Signed-off-by: Cai Xinchen <caixinchen1@huawei.com>
---
 security/integrity/ima/ima_iint.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/integrity/ima/ima_iint.c b/security/integrity/ima/ima_iint.c
index 00b249101f98..02efa8eef28e 100644
--- a/security/integrity/ima/ima_iint.c
+++ b/security/integrity/ima/ima_iint.c
@@ -59,7 +59,7 @@ static void ima_iint_init_always(struct ima_iint_cache *iint,
 				 struct inode *inode)
 {
 	iint->ima_hash = NULL;
-	iint->real_inode.version = 0;
+	integrity_inode_attrs_store(&iint->real_inode, 0, inode);
 	iint->flags = 0UL;
 	iint->atomic_flags = 0UL;
 	iint->ima_file_status = INTEGRITY_UNKNOWN;
-- 
2.18.0.huawei.25

Re: [PATCH] ima: initialize the real inode attributes of the iint cache

[Mimi Zohar]

On Mon, 2026-11-02 at 10:47 +0800, Cai Xinchen wrote:
> ima_iint_cache objects are allocated with kmem_cache_alloc() from a
> dedicated slab whose constructor only runs once, when the slab is first
> created; the constructor does not run again when a freed object is
> reallocated.  ima_iint_init_always() resets all iint fields except
> real_inode.ino and real_inode.dev, which therefore keep the values of
> the previously freed iint.
> 
> integrity_inode_attrs_changed() reads those fields in
> process_measurement() to detect changes to the backing file on stacked
> filesystems.  The fields are normally written by
> integrity_inode_attrs_store() from ima_collect_measurement(), but the
> IMA_HASH path sets IMA_HASHED without calling it, so on the next file
> open the stale, uninitialized ino and dev are read.  Depending on the
> residual values, IMA may skip re-evaluating a file whose backing data
> or metadata changed, or needlessly re-evaluate it.
> 
> Initialize real_inode.ino and real_inode.dev with the identification
> of the inode the iint is being associated with at allocation time.
> On stacked filesystems the first comparison against the underlying
> real inode will then fail until ima_collect_measurement() stores the
> real inode's attributes, which is the safe, conservative direction.
> 
> Fixes: b836c4d29f27 ("ima: detect changes to the backing overlay file")
> Signed-off-by: Cai Xinchen <caixinchen1@huawei.com>
> ---
>  security/integrity/ima/ima_iint.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/security/integrity/ima/ima_iint.c b/security/integrity/ima/ima_iint.c
> index 00b249101f98..02efa8eef28e 100644
> --- a/security/integrity/ima/ima_iint.c
> +++ b/security/integrity/ima/ima_iint.c
> @@ -59,7 +59,7 @@ static void ima_iint_init_always(struct ima_iint_cache *iint,
>  				 struct inode *inode)
>  {
>  	iint->ima_hash = NULL;
> -	iint->real_inode.version = 0;
> +	integrity_inode_attrs_store(&iint->real_inode, 0, inode);

Thanks, Cai.

Instead of calling integrity_inode_attrs_store(), reset the entire real_inode
structure. The store sets dev and ino to the stacked inode’s values, but at
allocation time there are no valid real-inode attributes yet, so the fields
should be cleared. The patch only works because the stacked and real inodes
happen to be on different superblocks.

The Fixes: tag looks wrong. In b836c4d29f27, real_inode is an unsigned long
version and init_always() resets it fully.

thanks,

Mimi

>  	iint->flags = 0UL;
>  	iint->atomic_flags = 0UL;
>  	iint->ima_file_status = INTEGRITY_UNKNOWN;

Re: [PATCH] ima: initialize the real inode attributes of the iint cache

[Cai Xinchen]

Hi Mimi. Thanks for review.

I mistakenly used integrity_inode_attrs_store. In the next version, I 
will directly use
memset to initialize the real_inode structure.

I double checked b836c4d29f27. That commit also added real_ino and 
real_dev to struct integrity_iinit_cache and started reading them in 
process_measurement(). However, iinit_init_always() only reset 
iint->version, leaving real_ino and real_dev stale. After 309e2b775da8, 
these three variables are encapsulated into integrity_inode_attributes. 
Therefore, I believe b836c4d29f27 is the appropriate Fixes tag. If I 
have missed anything, please let me know.

On 11/2/2026 7:20 PM, Mimi Zohar wrote:
> Thanks, Cai.
>
> Instead of calling integrity_inode_attrs_store(), reset the entire real_inode
> structure. The store sets dev and ino to the stacked inode’s values, but at
> allocation time there are no valid real-inode attributes yet, so the fields
> should be cleared. The patch only works because the stacked and real inodes
> happen to be on different superblocks.
>
> The Fixes: tag looks wrong. In b836c4d29f27, real_inode is an unsigned long
> version and init_always() resets it fully.