]> git.baikalelectronics.ru Git - kernel.git/commitdiff
revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules present")
authorPaul Moore <paul@paul-moore.com>
Tue, 28 Jul 2020 19:33:21 +0000 (15:33 -0400)
committerPaul Moore <paul@paul-moore.com>
Wed, 29 Jul 2020 14:00:36 +0000 (10:00 -0400)
Unfortunately the commit listed in the subject line above failed
to ensure that the task's audit_context was properly initialized/set
before enabling the "accompanying records".  Depending on the
situation, the resulting audit_context could have invalid values in
some of it's fields which could cause a kernel panic/oops when the
task/syscall exists and the audit records are generated.

We will revisit the original patch, with the necessary fixes, in a
future kernel but right now we just want to fix the kernel panic
with the least amount of added risk.

Cc: stable@vger.kernel.org
Fixes: 1320a4052ea1 ("audit: trigger accompanying records when no rules present")
Reported-by: j2468h@googlemail.com
Signed-off-by: Paul Moore <paul@paul-moore.com>
kernel/audit.c
kernel/audit.h
kernel/auditsc.c

index e33460e01b3b7f7f9026d9afafaf1774c842c88d..9bf2b08b051fbe8b0fbe59c0cc6138d3ddffcf5a 100644 (file)
@@ -1848,7 +1848,6 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
        }
 
        audit_get_stamp(ab->ctx, &t, &serial);
-       audit_clear_dummy(ab->ctx);
        audit_log_format(ab, "audit(%llu.%03lu:%u): ",
                         (unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial);
 
index f0233dc40b1730a4229fcc4d7f82ce00f76f8145..ddc22878433d014303c17be97a26dc68442a5212 100644 (file)
@@ -290,13 +290,6 @@ extern int audit_signal_info_syscall(struct task_struct *t);
 extern void audit_filter_inodes(struct task_struct *tsk,
                                struct audit_context *ctx);
 extern struct list_head *audit_killed_trees(void);
-
-static inline void audit_clear_dummy(struct audit_context *ctx)
-{
-       if (ctx)
-               ctx->dummy = 0;
-}
-
 #else /* CONFIG_AUDITSYSCALL */
 #define auditsc_get_stamp(c, t, s) 0
 #define audit_put_watch(w) {}
@@ -330,7 +323,6 @@ static inline int audit_signal_info_syscall(struct task_struct *t)
 }
 
 #define audit_filter_inodes(t, c) AUDIT_DISABLED
-#define audit_clear_dummy(c) {}
 #endif /* CONFIG_AUDITSYSCALL */
 
 extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);
index 468a2339045784c9260c2d80a1335b1090b3280a..fd840c40abf7ac4791d2fa724302ebe1241a67b1 100644 (file)
@@ -1417,6 +1417,9 @@ static void audit_log_proctitle(void)
        struct audit_context *context = audit_context();
        struct audit_buffer *ab;
 
+       if (!context || context->dummy)
+               return;
+
        ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE);
        if (!ab)
                return; /* audit_panic or being filtered */