github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

audit/stable-7.2 PR 20260730

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmprvkoUHHBhdWxAcGF1
 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXOc2hAAyvfOofGyPzcGVjyYdN9mla/eQ0Av
 qIDji0nXNF+cj07TGea/af4cWboc3iZnjF9mNNitI2cawMCsN53LdF3Cktc538ij
 cnGHXVRueG2btoCGvCD3carbo4dmEGFzB3+3HvPaUFYHrw2sft3+tuxqyssXx63f
 9MjMiky05WAsgKrZ5EAttJPJ6NeSR+Lbh5bFtRqHr3wPqvW2J3vEyowHIBz2dEjC
 y9zhgY6HoFWivi/8ftY9Xor9+RwHjH1AYRA/w9ZEzv28Uzcn1HWE+oR+vcOqquCN
 qagtqXtapA8RV1EtBd23Htwxg469zbaQiIjzQWqxje4wnXfw5eIriKXUY3hNH73S
 iaDjoEhX2wvlPk6rRKjEZTZCStkNTmQ/fTicuT9UcRW9WsLa0BGZNx7aomThwS6e
 5idm9KtvKPwRgtXbZlS4VTRqRu6haySevRxMZLe6CcsyutOFv0n/YcPfSWDJGvLQ
 Zzx6FamPQYk/xkyBGueFibw809hSf2Pi8jMbyIbMkunbukLzwJTCpa+LfECMWSi7
 pqG0H8KGEJUEW6VFDVtUtq0SaeVJN43oG920ExG2qRfLA2Wwr7hSnh93hreLCEDB
 YRgQn8YrmIeRGolA+UJNe1mFDxGnQzkcOQYs2XC1+MyIfUJNgCVHnd0mD69KcbXw
 exz8eKyXARs/LM8=
 =oqQe
 -----END PGP SIGNATURE-----

Merge tag 'audit-pr-20260730' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

Pull audit fixes from Paul Moore:

 - Fix potential integer overflows in audit_log_n_string()

   Similar to the earlier fix to audit_log_n_hex() that you merged
   earlier in July. Expect a cleaner, and generally better fix for these
   functions in an upcoming merge window, but this addresses the problem
   in a small patch that should be easy for people to backport.

 - Fix potential use-after-free in audit_del_rule()

* tag 'audit-pr-20260730' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: fix potential use-after-free in audit_del_rule()
  audit: fix potential integer overflow in audit_log_n_string()
This commit is contained in:
Linus Torvalds 2026-07-30 15:04:23 -07:00
commit 9e2e9da4de
2 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
kernel/audit.c
View File

@ -2120,7 +2120,8 @@ void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
void audit_log_n_string(struct audit_buffer *ab, const char *string,
size_t slen)
{
int avail, new_len;
int avail;
size_t new_len;
unsigned char *ptr;
struct sk_buff *skb;
@ -2130,7 +2131,13 @@ void audit_log_n_string(struct audit_buffer *ab, const char *string,
BUG_ON(!ab->skb);
skb = ab->skb;
avail = skb_tailroom(skb);
new_len = slen + 3; /* enclosing quotes + null terminator */
/* enclosing quotes + null terminator */
if (check_add_overflow(slen, 3, &new_len)) {
audit_log_format(ab, "?");
return;
}
if (new_len > avail) {
avail = audit_expand(ab, new_len);
if (!avail)

6
kernel/auditfilter.c
View File

@ -1045,6 +1045,10 @@ int audit_del_rule(struct audit_entry *entry)
goto out;
}
list_del_rcu(&e->list);
list_del(&e->rule.list);
synchronize_rcu();
if (e->rule.watch)
audit_remove_watch_rule(&e->rule);
@ -1062,8 +1066,6 @@ int audit_del_rule(struct audit_entry *entry)
audit_signals--;
#endif
list_del_rcu(&e->list);
list_del(&e->rule.list);
call_rcu(&e->rcu, audit_free_rule_rcu);
out: