From: Daniel Hodges <hodgesd@meta.com>
Date: Sun, 1 Feb 2026 02:40:15 +0000 (-0800)
Subject: ima: check return value of crypto_shash_final() in boot aggregate
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=870819434c8dfcc3158033b66e7851b81bb17e21;p=thirdparty%2Fkernel%2Flinux.git

ima: check return value of crypto_shash_final() in boot aggregate

The return value of crypto_shash_final() is not checked in
ima_calc_boot_aggregate_tfm(). If the hash finalization fails, the
function returns success and a corrupted boot aggregate digest could
be used for IMA measurements.

Capture the return value and propagate any error to the caller.

Fixes: 76bb28f6126f ("ima: use new crypto_shash API instead of old crypto_hash")
Signed-off-by: Daniel Hodges <hodgesd@meta.com>
Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---

diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index 10022b0db4d58..8f680ef18d8c3 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -838,7 +838,7 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id,
 		}
 	}
 	if (!rc)
-		crypto_shash_final(shash, digest);
+		rc = crypto_shash_final(shash, digest);
 	return rc;
 }