name_count array overrun
PATCH 1/1 name_count array overrun
Hi,
This patch removes the rdev logging from the previous patch
The below patch closes an unbounded use of name_count. This can lead to oopses in some new file systems.
Signed-off-by Steve Grubb <[email protected]>
kernel/auditsc.c +17 -2
@@ -1347,7 +1347,13 @@ void __audit_inode_child(const char *dna } update_context: - idx = context->name_count++; + idx = context->name_count; +if (context->name_count ==AUDIT_NAMES ) { +printk (KERN_DEBUG "name_count maxed and losing %s\n" , + found_name ?:"(null)" ); +return ; + } + context->name_count++;#if AUDIT_DEBUG context->ino_count++;#endif
@@ -1365,7 +1371,18 @@ update_context:/* A parent was not found in audit_names, so copy the inode data for the * provided parent. */ if (!found_name) { - idx = context->name_count++; + idx = context->name_count; +if (context->name_count ==AUDIT_NAMES ) { +printk (KERN_DEBUG +"name_count maxed and losing parent inode data: dev=%02x:%02x, inode=%lu" , +MAJOR (parent->i_sb->s_dev), +MINOR (parent->i_sb->s_dev), + parent->i_ino); +return ; + } + context->name_count++;#if AUDIT_DEBUG context->ino_count++;#endif
Quoted 8 lines · Steve Grubb
Hi,
This patch removes the rdev logging from the previous patch
The below patch closes an unbounded use of
name_count. This can lead to oopses in some new file systems.Signed-off-by Steve Grubb <[email protected]>
ACK, but please repost with a mailer that wouldn't eat patches. It's got serious tab damage.