audit: fix two bugs in the new execve audit code (040b3a2d) · Commits · 戴 / test

copy_from_user() returns the number of bytes not copied, hence 0 is the expected output. axi->mm might not be valid anymore when not equal to current->mm, do not dereference before checking that - thanks to Al for spotting that. Signed-off-by:

Peter Zijlstra <a.p.zijlstra@chello.nl> Tested-by:

Steve Grubb <sgrubb@redhat.com> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

kernel/auditsc.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -824,12 +824,14 @@ static void audit_log_execve_info(struct audit_buffer *ab,
		{
		int i;
		long len, ret;
		const char __user p = (const char __user )axi->mm->arg_start;
		const char __user *p;
		char *buf;

		if (axi->mm != current->mm)
		return; /* execve failed, no additional info */

		p = (const char __user *)axi->mm->arg_start;

		for (i = 0; i < axi->argc; i++, p += len) {
		len = strnlen_user(p, MAX_ARG_STRLEN);
		/*
		@@ -855,7 +857,7 @@ static void audit_log_execve_info(struct audit_buffer *ab,
		* copied them here, and the mm hasn't been exposed to user-
		* space yet.
		*/
		if (!ret) {
		if (ret) {
		WARN_ON(1);
		send_sig(SIGKILL, current, 0);
		}

Admin message