Commit 5e0f872c authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit

Pull audit fix from Paul Moore:
 "One audit patch to resolve a panic/oops when recording filenames in
  the audit log, see the mail archive link below.

  The fix isn't as nice as I would like, as it involves an allocate/copy
  of the filename, but it solves the problem and the overhead should
  only affect users who have configured audit rules involving file
  names.

  We'll revisit this issue with future kernels in an attempt to make
  this suck less, but in the meantime I think this fix should go into
  the next release of v3.19-rcX.

  [ https://marc.info/?t=141986927600001&r=1&w=2 ]"

* 'upstream' of git://git.infradead.org/users/pcmoore/audit:
  audit: create private file name copies when auditing inodes
parents 7f405483 fcf22d82
...@@ -72,6 +72,8 @@ ...@@ -72,6 +72,8 @@
#include <linux/fs_struct.h> #include <linux/fs_struct.h>
#include <linux/compat.h> #include <linux/compat.h>
#include <linux/ctype.h> #include <linux/ctype.h>
#include <linux/string.h>
#include <uapi/linux/limits.h>
#include "audit.h" #include "audit.h"
...@@ -1861,8 +1863,7 @@ void __audit_inode(struct filename *name, const struct dentry *dentry, ...@@ -1861,8 +1863,7 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
} }
list_for_each_entry_reverse(n, &context->names_list, list) { list_for_each_entry_reverse(n, &context->names_list, list) {
/* does the name pointer match? */ if (!n->name || strcmp(n->name->name, name->name))
if (!n->name || n->name->name != name->name)
continue; continue;
/* match the correct record type */ /* match the correct record type */
...@@ -1881,14 +1882,44 @@ void __audit_inode(struct filename *name, const struct dentry *dentry, ...@@ -1881,14 +1882,44 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN); n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
if (!n) if (!n)
return; return;
if (name) /* unfortunately, while we may have a path name to record with the
/* since name is not NULL we know there is already a matching * inode, we can't always rely on the string lasting until the end of
* name record, see audit_getname(), so there must be a type * the syscall so we need to create our own copy, it may fail due to
* mismatch; reuse the string path since the original name * memory allocation issues, but we do our best */
* record will keep the string valid until we free it in if (name) {
* audit_free_names() */ /* we can't use getname_kernel() due to size limits */
n->name = name; size_t len = strlen(name->name) + 1;
struct filename *new = __getname();
if (unlikely(!new))
goto out;
if (len <= (PATH_MAX - sizeof(*new))) {
new->name = (char *)(new) + sizeof(*new);
new->separate = false;
} else if (len <= PATH_MAX) {
/* this looks odd, but is due to final_putname() */
struct filename *new2;
new2 = kmalloc(sizeof(*new2), GFP_KERNEL);
if (unlikely(!new2)) {
__putname(new);
goto out;
}
new2->name = (char *)new;
new2->separate = true;
new = new2;
} else {
/* we should never get here, but let's be safe */
__putname(new);
goto out;
}
strlcpy((char *)new->name, name->name, len);
new->uptr = NULL;
new->aname = n;
n->name = new;
n->name_put = true;
}
out: out:
if (parent) { if (parent) {
n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL; n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment