mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-02-06 13:28:21 -05:00
Code Issues Packages Projects Releases Wiki Activity
Files
baa2a4fdd525c8c4b0f704d20457195b29437839
linux/kernel
History
Ronny Chevalier baa2a4fdd5 audit: fix use-after-free in audit_add_watch 
audit_add_watch stores locally krule->watch without taking a reference
on watch. Then, it calls audit_add_to_parent, and uses the watch stored
locally.

Unfortunately, it is possible that audit_add_to_parent updates
krule->watch.
When it happens, it also drops a reference of watch which
could free the watch.

How to reproduce (with KASAN enabled):

    auditctl -w /etc/passwd -F success=0 -k test_passwd
    auditctl -w /etc/passwd -F success=1 -k test_passwd2

The second call to auditctl triggers the use-after-free, because
audit_to_parent updates krule->watch to use a previous existing watch
and drops the reference to the newly created watch.

To fix the issue, we grab a reference of watch and we release it at the
end of the function.

Signed-off-by: Ronny Chevalier <ronny.chevalier@hp.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
2018-07-18 11:43:36 -04:00
..
bpf
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-06-16 07:39:34 +09:00
cgroup
docs: Fix some broken references
2018-06-15 18:10:01 -03:00
configs
kconfig: tinyconfig: remove stale stack protector fixups
2018-06-15 07:15:28 +09:00
debug
treewide: kzalloc() -> kcalloc()
2018-06-12 16:19:22 -07:00
events
treewide: kzalloc_node() -> kcalloc_node()
2018-06-12 16:19:22 -07:00
gcov
gcov: remove CONFIG_GCOV_FORMAT_AUTODETECT
2018-06-08 18:56:02 +09:00
irq
Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-06-10 09:44:53 -07:00
livepatch
livepatch: Allow to call a custom callback when freeing shadow variables
2018-04-17 13:42:48 +02:00
locking
treewide: kzalloc() -> kcalloc()
2018-06-12 16:19:22 -07:00
power
fix a series of Documentation/ broken file name references
2018-06-15 18:10:01 -03:00
printk
Merge tag 'printk-for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk
2018-06-06 16:04:55 -07:00
rcu
treewide: Use array_size() in vmalloc()
2018-06-12 16:19:22 -07:00
sched
sched/core / kcov: avoid kcov_area during task switch
2018-06-15 07:55:24 +09:00
time
Merge tag 'pm-4.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
2018-06-05 09:38:39 -07:00
trace
docs: Fix some broken references
2018-06-15 18:10:01 -03:00
.gitignore
…
acct.c
kernel/acct.c: fix the acct->needcheck check in check_free_space()
2018-01-04 16:45:09 -08:00
async.c
kernel/async.c: revert "async: simplify lowest_in_progress()"
2018-02-06 18:32:44 -08:00
audit_fsnotify.c
fsnotify: add fsnotify_add_inode_mark() wrappers
2018-05-18 14:58:22 +02:00
audit_tree.c
audit: check audit_enabled in audit_tree_log_remove_rule()
2018-06-28 11:41:02 -04:00
audit_watch.c
audit: fix use-after-free in audit_add_watch
2018-07-18 11:43:36 -04:00
audit.c
audit: use ktime_get_coarse_real_ts64() for timestamps
2018-07-17 14:45:08 -04:00
audit.h
audit: track the owner of the command mutex ourselves
2018-02-23 11:22:22 -05:00
auditfilter.c
audit: rename FILTER_TYPE to FILTER_EXCLUDE
2018-06-19 10:39:54 -04:00
auditsc.c
audit: use ktime_get_coarse_real_ts64() for timestamps
2018-07-17 14:45:08 -04:00
backtracetest.c
…
bounds.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
capability.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
compat.c
Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-06-04 20:27:54 -07:00
configs.c
…
context_tracking.c
…
cpu_pm.c
PM / CPU: replace raw_notifier with atomic_notifier
2017-07-31 13:09:49 +02:00
cpu.c
cpu/hotplug: Fix unused function warning
2018-03-15 20:34:40 +01:00
crash_core.c
mm: split page_type out from _mapcount
2018-06-07 17:34:37 -07:00
crash_dump.c
…
cred.c
doc: ReSTify credentials.txt
2017-05-18 10:30:19 -06:00
delayacct.c
delayacct: Use raw_spinlocks
2018-04-27 14:34:51 +02:00
dma.c
proc: introduce proc_create_single{,_data}
2018-05-16 07:23:35 +02:00
elfcore.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
exec_domain.c
proc: introduce proc_create_single{,_data}
2018-05-16 07:23:35 +02:00
exit.c
kernel: use kernel_wait4() instead of sys_wait4()
2018-04-02 20:14:51 +02:00
extable.c
extable: Make init_kernel_text() global
2018-02-21 16:54:06 +01:00
fail_function.c
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
fork.c
mm: check for SIGKILL inside dup_mmap() loop
2018-06-15 07:55:24 +09:00
freezer.c
…
futex_compat.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
futex.c
pids: introduce find_get_task_by_vpid() helper
2018-02-06 18:32:46 -08:00
groups.c
kernel: make groups_sort calling a responsibility group_info allocators
2017-12-14 16:00:49 -08:00
hung_task.c
kernel/hung_task.c: show all hung tasks before panic
2018-06-07 17:34:39 -07:00
iomem.c
memremap: split devm_memremap_pages() and memremap() infrastructure
2018-05-15 23:08:33 -07:00
irq_work.c
irq/work: Improve the flag definitions
2018-01-08 19:43:15 +01:00
jump_label.c
jump_label: Disable jump labels in __exit code
2018-03-20 08:57:17 +01:00
kallsyms.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk
2018-02-01 13:36:15 -08:00
kcmp.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
Kconfig.freezer
…
Kconfig.hz
…
Kconfig.locks
…
Kconfig.preempt
…
kcov.c
sched/core / kcov: avoid kcov_area during task switch
2018-06-15 07:55:24 +09:00
kexec_core.c
kexec: yield to scheduler when loading kimage segments
2018-06-15 07:55:24 +09:00
kexec_file.c
treewide: Use array_size() in vzalloc()
2018-06-12 16:19:22 -07:00
kexec_internal.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
kexec.c
kexec: call do_kexec_load() in compat syscall directly
2018-04-02 20:15:01 +02:00
kmod.c
kmod: move #ifdef CONFIG_MODULES wrapper to Makefile
2017-09-08 18:26:51 -07:00
kprobes.c
kprobes: Fix random address output of blacklist file
2018-04-25 10:27:56 -04:00
ksysfs.c
kexec: move vmcoreinfo out of the kernel's .bss section
2017-07-12 16:25:59 -07:00
kthread.c
kthread: Allow kthread_park() on a parked kthread
2018-05-25 08:03:51 +02:00
latencytop.c
…
Makefile
Merge branch 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-06-10 10:17:09 -07:00
memremap.c
mm: introduce MEMORY_DEVICE_FS_DAX and CONFIG_DEV_PAGEMAP_OPS
2018-05-22 06:59:39 -07:00
module_signing.c
…
module-internal.h
…
module.c
Merge tag 'modules-for-v4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux
2018-06-16 07:36:39 +09:00
notifier.c
…
nsproxy.c
…
padata.c
padata: add SPDX identifier
2018-01-05 18:43:00 +11:00
panic.c
Kbuild: rename CC_STACKPROTECTOR[_STRONG] config variables
2018-06-14 12:21:18 +09:00
params.c
kernel/params.c: downgrade warning for unsafe parameters
2018-04-11 10:28:37 -07:00
pid_namespace.c
Merge branch 'userns-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2018-04-03 19:15:32 -07:00
pid.c
xarray: add the xa_lock to the radix_tree_root
2018-04-11 10:28:39 -07:00
profile.c
…
ptrace.c
pids: introduce find_get_task_by_vpid() helper
2018-02-06 18:32:46 -08:00
range.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
reboot.c
kernel/reboot.c: add devm_register_reboot_notifier()
2017-11-17 16:10:04 -08:00
relay.c
kernel/relay.c: change return type to vm_fault_t
2018-06-15 07:55:24 +09:00
resource.c
Merge tag 'libnvdimm-for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
2018-06-08 17:21:52 -07:00
rseq.c
rseq: Introduce restartable sequences system call
2018-06-06 11:58:31 +02:00
seccomp.c
Merge tag 'audit-pr-20180605' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
2018-06-06 16:34:00 -07:00
signal.c
signal: Remove no longer required irqsave/restore
2018-06-10 06:14:01 +02:00
smp.c
smp/core: Use lockdep to assert IRQs are disabled/enabled
2017-11-08 11:13:50 +01:00
smpboot.c
watchdog/core, powerpc: Lock cpus across reconfiguration
2017-10-04 10:53:54 +02:00
smpboot.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
softirq.c
Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-06-04 19:59:22 -07:00
stacktrace.c
…
stop_machine.c
Merge tag 'v4.17-rc5' into locking/core, to pick up fixes
2018-05-15 08:10:50 +02:00
sys_ni.c
Merge branch 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-06-10 10:17:09 -07:00
sys.c
mm: introduce arg_lock to protect arg_start|end and env_start|end in mm_struct
2018-06-07 17:34:34 -07:00
sysctl_binary.c
staging: irda: remove remaining remants of irda code removal
2018-04-16 11:26:49 +02:00
sysctl.c
treewide: kzalloc() -> kcalloc()
2018-06-12 16:19:22 -07:00
task_work.c
locking/barriers: Convert users of lockless_dereference() to READ_ONCE()
2017-12-17 13:57:15 +01:00
taskstats.c
pids: introduce find_get_task_by_vpid() helper
2018-02-06 18:32:46 -08:00
test_kprobes.c
kprobes: Disable the jprobes test code
2017-10-20 11:02:54 +02:00
torture.c
rcu: Rename cond_resched_rcu_qs() to cond_resched_tasks_rcu_qs()
2018-05-15 10:27:29 -07:00
tracepoint.c
tracepoints: Fix the descriptions of tracepoint_probe_register{_prio}
2018-05-28 12:49:51 -04:00
tsacct.c
…
ucount.c
headers: untangle kmemleak.h from mm.h
2018-04-05 21:36:27 -07:00
uid16.c
fs: add do_fchownat(), ksys_fchown() helpers and ksys_{,l}chown() wrappers
2018-04-02 20:15:59 +02:00
uid16.h
kernel: provide ksys_*() wrappers for syscalls called by kernel/uid16.c
2018-04-02 20:15:30 +02:00
umh.c
umh: fix race condition
2018-06-07 16:56:28 -04:00
up.c
smp: Avoid using two cache lines for struct call_single_data
2017-08-29 15:14:38 +02:00
user_namespace.c
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
user-return-notifier.c
…
user.c
efivarfs: Limit the rate for non-root to read files
2018-02-22 10:21:02 -08:00
utsname_sysctl.c
…
utsname.c
uts: create "struct uts_namespace" from kmem_cache
2018-04-11 10:28:35 -07:00
watchdog_hld.c
Merge branch 'linus' into core/urgent, to pick up dependent commits
2017-11-04 08:53:04 +01:00
watchdog.c
Merge branch 'linus' into sched/core, to pick up fixes
2017-11-08 10:17:15 +01:00
workqueue_internal.h
workqueue: Set worker->desc to workqueue name by default
2018-05-18 08:47:13 -07:00
workqueue.c
treewide: kzalloc() -> kcalloc()
2018-06-12 16:19:22 -07:00