path: root/kernel/audit.c
diff options
authorPaul Moore <paul@paul-moore.com>2020-02-22 20:36:47 -0500
committerPaul Moore <paul@paul-moore.com>2020-02-22 20:36:47 -0500
commit2ad3e17ebf94b7b7f3f64c050ff168f9915345eb (patch)
tree4f91f75912932d7ca7cf2a53d60719434b84ff1d /kernel/audit.c
parentcb5172d96d16df72db8b55146b0ec00bfd97f079 (diff)
audit: fix error handling in audit_data_to_entry()
Commit 219ca39427bf ("audit: use union for audit_field values since they are mutually exclusive") combined a number of separate fields in the audit_field struct into a single union. Generally this worked just fine because they are generally mutually exclusive. Unfortunately in audit_data_to_entry() the overlap can be a problem when a specific error case is triggered that causes the error path code to attempt to cleanup an audit_field struct and the cleanup involves attempting to free a stored LSM string (the lsm_str field). Currently the code always has a non-NULL value in the audit_field.lsm_str field as the top of the for-loop transfers a value into audit_field.val (both .lsm_str and .val are part of the same union); if audit_data_to_entry() fails and the audit_field struct is specified to contain a LSM string, but the audit_field.lsm_str has not yet been properly set, the error handling code will attempt to free the bogus audit_field.lsm_str value that was set with audit_field.val at the top of the for-loop. This patch corrects this by ensuring that the audit_field.val is only set when needed (it is cleared when the audit_field struct is allocated with kcalloc()). It also corrects a few other issues to ensure that in case of error the proper error code is returned. Cc: stable@vger.kernel.org Fixes: 219ca39427bf ("audit: use union for audit_field values since they are mutually exclusive") Reported-by: syzbot+1f4d90ead370d72e450b@syzkaller.appspotmail.com Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'kernel/audit.c')
0 files changed, 0 insertions, 0 deletions

Privacy Policy