mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 15:43:08 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'audit-pr-20260730' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

Browse Source 
Pull audit fixes from Paul Moore:

 - Fix potential integer overflows in audit_log_n_string()

   Similar to the earlier fix to audit_log_n_hex() that you merged
   earlier in July. Expect a cleaner, and generally better fix for these
   functions in an upcoming merge window, but this addresses the problem
   in a small patch that should be easy for people to backport.

 - Fix potential use-after-free in audit_del_rule()

* tag 'audit-pr-20260730' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: fix potential use-after-free in audit_del_rule()
  audit: fix potential integer overflow in audit_log_n_string()
This commit is contained in:
Linus Torvalds
2026-07-30 15:04:23 -07:00
parent 3708dd9488 246df90b5f
commit 9e2e9da4de
2 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
kernel/audit.c
View File

@@ -2120,7 +2120,8 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
void audit_log_n_string(struct audit_buffer *ab, const char *string,
size_t slen)
{
int avail, new_len;
int avail;
size_t new_len;
unsigned char *ptr;
struct sk_buff *skb;
@@ -2130,7 +2131,13 @@ void audit_log_n_string(struct audit_buffer *ab, const char *string,
BUG_ON(!ab->skb);
skb = ab->skb;
avail = skb_tailroom(skb);
new_len = slen + 3; /* enclosing quotes + null terminator */
/* enclosing quotes + null terminator */
if (check_add_overflow(slen, 3, &new_len)) {
audit_log_format(ab, "?");
return;
}
if (new_len > avail) {
avail = audit_expand(ab, new_len);
if (!avail)

6
kernel/auditfilter.c
View File

@@ -1045,6 +1045,10 @@ int audit_del_rule(struct audit_entry *entry)
goto out;
}
list_del_rcu(&e->list);
list_del(&e->rule.list);
synchronize_rcu();
if (e->rule.watch)
audit_remove_watch_rule(&e->rule);
@@ -1062,8 +1066,6 @@ int audit_del_rule(struct audit_entry *entry)
audit_signals--;
#endif
list_del_rcu(&e->list);
list_del(&e->rule.list);
call_rcu(&e->rcu, audit_free_rule_rcu);
out: