Commit 3054d067 authored by Paul Moore's avatar Paul Moore
Browse files

audit: fix a net reference leak in audit_list_rules_send() 



If audit_list_rules_send() fails when trying to create a new thread
to send the rules it also fails to cleanup properly, leaking a
reference to a net structure.  This patch fixes the error patch and
renames audit_send_list() to audit_send_list_thread() to better
match its cousin, audit_send_reply_thread().

Reported-by: default avatar <teroincn@gmail.com>
Reviewed-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent a48b284b

kernel/audit.c

+1 −1
Original line number Diff line number Diff line
@@ -880,7 +880,7 @@ main_queue: 
	return 0;

}



int audit_send_list(void *_dest)

int audit_send_list_thread(void *_dest)

{

	struct audit_netlink_list *dest = _dest;

	struct sk_buff *skb;

kernel/audit.h

+1 −1
Original line number Diff line number Diff line
@@ -229,7 +229,7 @@ struct audit_netlink_list { 
	struct sk_buff_head q;

};



int audit_send_list(void *_dest);

int audit_send_list_thread(void *_dest);



extern int selinux_audit_rule_update(void);

kernel/auditfilter.c

+7 −9
Original line number Diff line number Diff line
@@ -1161,11 +1161,8 @@ int audit_rule_change(int type, int seq, void *data, size_t datasz) 
 */

int audit_list_rules_send(struct sk_buff *request_skb, int seq)

{

	u32 portid = NETLINK_CB(request_skb).portid;

	struct net *net = sock_net(NETLINK_CB(request_skb).sk);

	struct task_struct *tsk;

	struct audit_netlink_list *dest;

	int err = 0;



	/* We can't just spew out the rules here because we might fill

	 * the available socket buffer space and deadlock waiting for
@@ -1173,25 +1170,26 @@ int audit_list_rules_send(struct sk_buff *request_skb, int seq) 
	 * happen if we're actually running in the context of auditctl

	 * trying to _send_ the stuff */



	dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL);

	dest = kmalloc(sizeof(*dest), GFP_KERNEL);

	if (!dest)

		return -ENOMEM;

	dest->net = get_net(net);

	dest->portid = portid;

	dest->net = get_net(sock_net(NETLINK_CB(request_skb).sk));

	dest->portid = NETLINK_CB(request_skb).portid;

	skb_queue_head_init(&dest->q);



	mutex_lock(&audit_filter_mutex);

	audit_list_rules(seq, &dest->q);

	mutex_unlock(&audit_filter_mutex);



	tsk = kthread_run(audit_send_list, dest, "audit_send_list");

	tsk = kthread_run(audit_send_list_thread, dest, "audit_send_list");

	if (IS_ERR(tsk)) {

		skb_queue_purge(&dest->q);

		put_net(dest->net);

		kfree(dest);

		err = PTR_ERR(tsk);

		return PTR_ERR(tsk);

	}



	return err;

	return 0;

}



int audit_comparator(u32 left, u32 op, u32 right)

CRA Git | Maintained and supported by SUSTech CRA and CCSE