Commit 290e44b7 authored Jul 17, 2018 by Paul Moore

audit: use ktime_get_coarse_real_ts64() for timestamps



Commit c72051d5 ("audit: use ktime_get_coarse_ts64() for time
access") converted audit's use of current_kernel_time64() to the
new ktime_get_coarse_ts64() function.  Unfortunately this resulted
in incorrect timestamps, e.g. events stamped with the year 1969
despite it being 2018.  This patch corrects this by using
ktime_get_coarse_real_ts64() just like the current_kernel_time64()
wrapper.

Fixes: c72051d5 ("audit: use ktime_get_coarse_ts64() for time access")
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>

parent c72051d5

kernel/audit.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1721,7 +1721,7 @@ static inline void audit_get_stamp(struct audit_context *ctx,
		struct timespec64 t, unsigned int serial)
		{
		if (!ctx \|\| !auditsc_get_stamp(ctx, t, serial)) {
		ktime_get_coarse_ts64(t);
		ktime_get_coarse_real_ts64(t);
		*serial = audit_serial();
		}
		}

kernel/auditsc.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1543,7 +1543,7 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
		context->in_syscall = 1;
		context->current_state = state;
		context->ppid = 0;
		ktime_get_coarse_ts64(&context->ctime);
		ktime_get_coarse_real_ts64(&context->ctime);
		}

		/**

Admin message