FAILED: patch "[PATCH] audit: fix potential integer overflow in audit_log_n_hex()" failed to apply to 6.1-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 65dfde57d1e29ce2b76fc23dd565eccd5c0bc0f0
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026071526-proposal-crusher-04da@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 65dfde57d1e29ce2b76fc23dd565eccd5c0bc0f0 Mon Sep 17 00:00:00 2001
From: Ricardo Robaina <[email protected]>
Date: Thu, 2 Jul 2026 11:04:11 -0300
Subject: [PATCH] audit: fix potential integer overflow in audit_log_n_hex()
The function calculates new_len as len << 1 for hex encoding. This has two overflow risks: the shift itself can overflow when len is large, and the result can be truncated when assigned to new_len (declared as int) from the size_t calculation.
Fix by using check_shl_overflow() to catch shift overflow and changing new_len and loop counter i to size_t to prevent truncation.
kernel/audit.c +9 -2
@@ -62,6 +62,7 @@#include <net/ip.h> #include <net/ipv6.h> #include <linux/sctp.h> +#include <linux/overflow.h> #include "audit.h"
@@ -2080,7 +2081,8 @@ void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)void audit_log_n_hex (struct audit_buffer *ab,const unsigned char *buf,size_t len) { -int i, avail, new_len; +int avail; +size_t i, new_len;unsigned char *ptr;struct sk_buff *skb;
@@ -2090,7 +2092,12 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,BUG_ON (!ab->skb); skb = ab->skb; avail =skb_tailroom (skb); - new_len = len<<1 ; + +if (check_shl_overflow (len,1 , &new_len)) { +audit_log_format (ab,"?" ); +return ; + } +if (new_len >= avail) {/* Round the buffer request up to the next multiple */ new_len =AUDIT_BUFSIZ *(((new_len-avail)/AUDIT_BUFSIZ ) +1 );
Sasha Levin
maintainerPATCH 1/2 audit: add audit_log_nf_skb helper function
From: Ricardo Robaina <[email protected]>
[ Upstream commit f19590b07cb620be1fcd5474c49515e21a05d406 ]
Netfilter code (net/netfilter/nft_log.c and net/netfilter/xt_AUDIT.c) have to be kept in sync. Both source files had duplicated versions of audit_ip4() and audit_ip6() functions, which can result in lack of consistency and/or duplicated work.
This patch adds a helper function in audit.c that can be called by netfilter code commonly, aiming to improve maintainability and consistency.
Stable-dep-of: 65dfde57d1e2 ("audit: fix potential integer overflow in audit_log_n_hex()")
--- include/linux/audit.h | 8 +++++ kernel/audit.c | 64 ++++++++++++++++++++++++++++++++++++++++ net/netfilter/nft_log.c | 58 +----------------------------------- net/netfilter/xt_AUDIT.c | 58 +----------------------------------- 4 files changed, 74 insertions(+), 114 deletions(-)
include/linux/audit.h +8 -0
@@ -177,6 +177,8 @@ extern void audit_log_lost(const char *message);extern int audit_log_task_context (struct audit_buffer *ab);extern void audit_log_task_info (struct audit_buffer *ab); +extern int audit_log_nf_skb (struct audit_buffer *ab, +const struct sk_buff *skb,u8 nfproto);extern int audit_update_lsm_rules (void );
@@ -242,6 +244,12 @@ static inline int audit_log_task_context(struct audit_buffer *ab)static inline void audit_log_task_info (struct audit_buffer *ab) { } +static inline int audit_log_nf_skb (struct audit_buffer *ab, +const struct sk_buff *skb,u8 nfproto) +{ +return 0 ; +} +static inline kuid_t audit_get_loginuid (struct task_struct *tsk) {return INVALID_UID ;
kernel/audit.c +64 -0
76 lines not on this page · raw message
net/netfilter/nft_log.c +1 -57
74 lines not on this page · raw message
net/netfilter/xt_AUDIT.c +1 -57
74 lines not on this page · raw message
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/2 audit: fix potential integer overflow in audit_log_n_hex()
From: Ricardo Robaina <[email protected]>
[ Upstream commit 65dfde57d1e29ce2b76fc23dd565eccd5c0bc0f0 ]
The function calculates new_len as len << 1 for hex encoding. This has two overflow risks: the shift itself can overflow when len is large, and the result can be truncated when assigned to new_len (declared as int) from the size_t calculation.
Fix by using check_shl_overflow() to catch shift overflow and changing new_len and loop counter i to size_t to prevent truncation.
--- kernel/audit.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
kernel/audit.c +9 -2
@@ -61,6 +61,7 @@#include <net/netns/generic.h> #include <net/ip.h> #include <net/ipv6.h> +#include <linux/overflow.h> #include "audit.h"
@@ -2035,7 +2036,8 @@ void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)void audit_log_n_hex (struct audit_buffer *ab,const unsigned char *buf,size_t len) { -int i, avail, new_len; +int avail; +size_t i, new_len;unsigned char *ptr;struct sk_buff *skb;
@@ -2045,7 +2047,12 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,BUG_ON (!ab->skb); skb = ab->skb; avail =skb_tailroom (skb); - new_len = len<<1 ; + +if (check_shl_overflow (len,1 , &new_len)) { +audit_log_format (ab,"?" ); +return ; + } +if (new_len >= avail) {/* Round the buffer request up to the next multiple */ new_len =AUDIT_BUFSIZ *(((new_len-avail)/AUDIT_BUFSIZ ) +1 );
Signature · 1 line
2.53.0