linux-kernel - [PATCH 1/2] audit: flush_hold_queue(): don't drop queued SKBs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1378183735-19338-2-git-send-email-lcapitulino@redhat.com>
Date:	Tue,  3 Sep 2013 00:48:54 -0400
From:	Luiz Capitulino <lcapitulino@...hat.com>
To:	linux-kernel@...r.kernel.org
Cc:	viro@...iv.linux.org.uk, eparis@...hat.com, dan.duval@...cle.com,
	akpm@...ux-foundation.org, rgb@...hat.com, oleg@...hat.com,
	chuck.anderson@...cle.com
Subject: [PATCH 1/2] audit: flush_hold_queue(): don't drop queued SKBs

From: Luiz capitulino <lcapitulino@...hat.com>

flush_hold_queue() first dequeues an SKB and then checks if
auditd exists. If auditd doesn't exist, the SKB is silently
dropped.

Avoid this by not dequeing an SKB when we detected that
auditd disappeared.

Signed-off-by: Luiz capitulino <lcapitulino@...hat.com>
---
 kernel/audit.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index 91e53d0..475c1d1 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -380,7 +380,7 @@ static void audit_printk_skb(struct sk_buff *skb)
 	audit_hold_skb(skb);
 }
 
-static void kauditd_send_skb(struct sk_buff *skb)
+static int kauditd_send_skb(struct sk_buff *skb)
 {
 	int err;
 	/* take a reference in case we can't send it and we want to hold it */
@@ -393,9 +393,12 @@ static void kauditd_send_skb(struct sk_buff *skb)
 		audit_pid = 0;
 		/* we might get lucky and get this in the next auditd */
 		audit_hold_skb(skb);
+		return err;
 	} else
 		/* drop the extra reference if sent ok */
 		consume_skb(skb);
+
+	return 0;
 }
 
 /*
@@ -416,6 +419,7 @@ static void kauditd_send_skb(struct sk_buff *skb)
 static void flush_hold_queue(void)
 {
 	struct sk_buff *skb;
+	int err;
 
 	if (!audit_default || !audit_pid)
 		return;
@@ -424,17 +428,12 @@ static void flush_hold_queue(void)
 	if (likely(!skb))
 		return;
 
-	while (skb && audit_pid) {
-		kauditd_send_skb(skb);
+	while (skb) {
+		err = kauditd_send_skb(skb);
+		if (err)
+			break;
 		skb = skb_dequeue(&audit_skb_hold_queue);
 	}
-
-	/*
-	 * if auditd just disappeared but we
-	 * dequeued an skb we need to drop ref
-	 */
-	if (skb)
-		consume_skb(skb);
 }
 
 static int kauditd_thread(void *dummy)
-- 
1.8.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/