Fix the kernel panic of audit_filter_task when key field is set
PATCH 1/1 Fix the kernel panic of audit_filter_task when key field is set
When calling audit_filter_task(), it calls audit_filter_rules() with audit_context is NULL. If the key field is set, the result in audit_filter_rules() will be set to 1 and ctx->filterkey will be set to key.
But the ctx is NULL in this condition, so kernel will panic.
--- kernel/auditsc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
kernel/auditsc.c +1 -1
@@ -610,7 +610,7 @@ static int audit_filter_rules(struct task_struct *tsk,if (!result)return 0 ; } -if (rule->filterkey) +if (rule->filterkey && ctx) ctx->filterkey =kstrdup (rule->filterkey,GFP_ATOMIC );switch (rule->action) {case AUDIT_NEVER : *state =AUDIT_DISABLED ;break ;
[PATCH] Fix the kernel panic of audit_filter_task when AUDIT_PERM or AUDIT_FILETYPE field is set
When calling audit_filter_task(), it calls audit_filter_rules() with audit_context is NULL.
If the AUDIT_PERM or AUDIT_FILETYPE field is set, audit_match_perm() or audit_match_filetype() will use ctx->xx. But the ctx is NULL in this condition, so kernel will panic.
--- kernel/auditsc.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
kernel/auditsc.c +4 -0
@@ -243,6 +243,8 @@ static inline int open_arg(int flags, int mask)static int audit_match_perm (struct audit_context *ctx,int mask) { +if (!ctx) +return 0 ;unsigned n = ctx->major;switch (audit_classify_syscall (ctx->arch, n)) {case 0 :/* native */
@@ -284,6 +286,8 @@ static int audit_match_filetype(struct audit_context *ctx, int which) {unsigned index = which & ~S_IFMT ;mode_t mode = which &S_IFMT ; +if (!ctx) +return 0 ;if (index >= ctx->name_count)return 0 ;if (ctx->names[index].ino ==-1 )
zhangxiliang said the following on 2008-08-01 19:15:
Quoted 31 lines
When calling
audit_filter_task(), it callsaudit_filter_rules()withaudit_contextis NULL. If the key field is set, the result inaudit_filter_rules()will be set to 1 andctx->filterkeywill be set to key.
But the ctx is NULL in this condition, so kernel will panic.Signed-off-by Zhang Xiliang <[email protected]>--- kernel/auditsc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)kernel/auditsc.c +1
-2@@ -610,7 +610,7 @@ static int audit_filter_rules(struct task_struct *tsk,if (!result)return 0 ; } -if (rule->filterkey) +if (rule->filterkey && ctx) ctx->filterkey =kstrdup (rule->filterkey,GFP_ATOMIC );switch (rule->action) {case AUDIT_NEVER : *state =AUDIT_DISABLED ;break ; --Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
kernel/auditsc.c static inline int open_arg(int flags, int mask) · line 248
Quoted 5 lines · zhangxiliang
static int
audit_match_perm(struct audit_context *ctx, int mask){kernel/auditsc.c +2
-0+if (!ctx) +return 0 ;unsigned n = ctx->major;
Please check this patch with scripts/checkpatch.pl and then resend it.
Quoted 13 lines
kernel/auditsc.c +2
-0switch (audit_classify_syscall (ctx->arch, n)) {case 0 :/* native */ @@ -284,6 +286,8 @@ static int audit_match_filetype(struct audit_context *ctx, int which) {unsigned index = which & ~S_IFMT ;mode_t mode = which &S_IFMT ; +if (!ctx) +return 0 ;if (index >= ctx->name_count)return 0 ;if (ctx->names[index].ino ==-1 )
Sorry, I miss a blank between if and "(".
And I add "unlikely" to check "ctx" in audit_match_perm() and audit_match_filetype(). This is a new patch for it.
--- kernel/auditsc.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-)
kernel/auditsc.c +7 -0
@@ -243,6 +243,9 @@ static inline int open_arg(int flags, int mask)static int audit_match_perm (struct audit_context *ctx,int mask) { +if (unlikely (!ctx)) +return 0 ; +unsigned n = ctx->major;switch (audit_classify_syscall (ctx->arch, n)) {case 0 :/* native */
@@ -284,6 +287,10 @@ static int audit_match_filetype(struct audit_context *ctx, int which) {unsigned index = which & ~S_IFMT ;mode_t mode = which &S_IFMT ; + +if (unlikely (!ctx)) +return 0 ; +if (index >= ctx->name_count)return 0 ;if (ctx->names[index].ino ==-1 )
Yu Zhiguo said the following on 2008-08-02 10:51:
Quoted 30 lines
Review
Quoted 5 lines · zhangxiliang
static int
audit_match_perm(struct audit_context *ctx, int mask){(quoted diff) +2
-0+ if(!ctx) + return 0; unsigned n = ctx->major;Please check this patch with
scripts/checkpatch.pland then resend it.Quoted 14 lines
switch (audit_classify_syscall(ctx->arch, n)) { case 0: /* native */(quoted diff) +2
-0@@ -284,6 +286,8 @@ static int audit_match_filetype(struct audit_context *ctx, int which) { unsigned index = which & ~S_IFMT; mode_t mode = which & S_IFMT; + if(!ctx) + return 0; if (index >= ctx->name_count) return 0;if (ctx->names[index].ino == -1)
Quoted 3 lines · zhangxiliang
Sorry, I miss a blank between if and "(".
And I add "unlikely" to check "ctx" inaudit_match_perm()andaudit_match_filetype(). This is a new patch for it.
Thanks. Applied and pushed.
PATCH 1/1 fix warning in audit_match_perm
In reply to zhangxiliangkernel/auditsc.c: In function ‘audit_match_perm’:kernel/auditsc.c:249: warning: ISO C90 forbids mixed declarations and code
This was introduced in commit1a61c88defcd611bd148d6c960b498e1b8bbbe00
--- kernel/auditsc.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-)
kernel/auditsc.c +3 -1
@@ -243,10 +243,12 @@ static inline int open_arg(int flags, int mask)static int audit_match_perm (struct audit_context *ctx,int mask) { +unsigned n; +if (unlikely (!ctx))return 0 ; -unsigned n = ctx->major; + n = ctx->major;switch (audit_classify_syscall (ctx->arch, n)) {case 0 :/* native */ if ((mask & AUDIT_PERM_WRITE) &&
Signature · 1 line
1.6.0