leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge tag 'audit-pr-20210830' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

Browse Source 
Pull audit updates from Paul Moore:
 "Two patches in the audit pull request for v5.15; one is trivial
  ("header protection") but the second is a real patch that fixes a
  refcounting problem.

  The refcount fix normally would have been sent up during the -rcX
  cycle, but since we merged it less than a week before v5.14 proper I
  felt it was better to wait for the merge window to open; the patch is
  marked with the usual -stable markings"

* tag 'audit-pr-20210830' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: move put_tree() to avoid trim_trees refcount underflow and UAF
  audit: add header protection to kernel/audit.h
This commit is contained in:
Linus Torvalds
2021-08-31 12:55:50 -07:00
parent befa491ce6 67d69e9d1a
commit 8e0cd9525c
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
kernel/audit.h
View File

@@ -6,6 +6,9 @@
* Copyright 2005 IBM Corporation * Copyright 2005 IBM Corporation
*/ */
#ifndef _KERNEL_AUDIT_H_
#define _KERNEL_AUDIT_H_
#include <linux/fs.h> #include <linux/fs.h>
#include <linux/audit.h> #include <linux/audit.h>
#include <linux/skbuff.h> #include <linux/skbuff.h>
@@ -331,3 +334,5 @@ extern int audit_filter(int msgtype, unsigned int listtype);
extern void audit_ctl_lock(void); extern void audit_ctl_lock(void);
extern void audit_ctl_unlock(void); extern void audit_ctl_unlock(void);
#endif

2
kernel/audit_tree.c
View File

@@ -593,7 +593,6 @@ static void prune_tree_chunks(struct audit_tree *victim, bool tagged)
spin_lock(&hash_lock); spin_lock(&hash_lock);
} }
spin_unlock(&hash_lock); spin_unlock(&hash_lock);
put_tree(victim);
} }
/* /*
@@ -602,6 +601,7 @@ static void prune_tree_chunks(struct audit_tree *victim, bool tagged)
static void prune_one(struct audit_tree *victim) static void prune_one(struct audit_tree *victim)
{ {
prune_tree_chunks(victim, false); prune_tree_chunks(victim, false);
put_tree(victim);
} }
/* trim the uncommitted chunks from tree */ /* trim the uncommitted chunks from tree */