linux-kernel - Re: [PATCH] audit: remove the audit freelist

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20161130044422.GH6897@madcap2.tricolour.ca>
Date:   Tue, 29 Nov 2016 23:44:22 -0500
From:   Richard Guy Briggs <rgb@...hat.com>
To:     Florian Westphal <fw@...len.de>
Cc:     linux-audit@...hat.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] audit: remove the audit freelist

On 2016-11-29 18:24, Florian Westphal wrote:
> Richard Guy Briggs <rgb@...hat.com> wrote:
> > >  static void audit_buffer_free(struct audit_buffer *ab)
> > >  {
> > > -	unsigned long flags;
> > > -
> > >  	if (!ab)
> > >  		return;
> > >  
> > >  	kfree_skb(ab->skb);
> > > -	spin_lock_irqsave(&audit_freelist_lock, flags);
> > > -	if (audit_freelist_count > AUDIT_MAXFREE)
> > > -		kfree(ab);
> > > -	else {
> > > -		audit_freelist_count++;
> > > -		list_add(&ab->list, &audit_freelist);
> > > -	}
> > > -	spin_unlock_irqrestore(&audit_freelist_lock, flags);
> > > +	kfree(ab);
> > >  }
> [..]
> 
> > >  	nlh = nlmsg_put(ab->skb, 0, 0, type, 0, 0);
> > >  	if (!nlh)
> > > -		goto out_kfree_skb;
> > > +		goto err;
> > >  
> > >  	return ab;
> > >  
> > > -out_kfree_skb:
> > > -	kfree_skb(ab->skb);
> > > -	ab->skb = NULL;
> > 
> > Why is the kfree_skb() skipped on error from nlmsg_put()?  I don't see
> > much risk in nlmsg_put() failing considering the very simple arguments,
> > however the code path is not trivial either.
> 
> if nlmsg_put fails we jump to err and ...
> 
> > >  err:
> > >  	audit_buffer_free(ab);
> > >  	return NULL;
> 
> ... ab->skb gets free'd by audit_buffer_free() here.

Duh, thank you!  It was already redundant in plain sight in your patch.
Sorry for the brain fart.  :)

Reviewed-by: Richard Guy Briggs <rgb@...hat.com>

- RGB

--
Richard Guy Briggs <rgb@...hat.com>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635