linux-kernel - Re: [Question] audit_names use after delete in audit_filter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHC9VhS8Rq8J9MBUvqNeEO9pQRzx7mT=EfDagw=MQ2oO8jHbyw@mail.gmail.com>
Date:   Mon, 26 Aug 2019 16:42:52 -0400
From:   Paul Moore <paul@...l-moore.com>
To:     Chen Wandun <chenwandun@...wei.com>
Cc:     linux-kernel@...r.kernel.org, linux-audit@...hat.com,
        Eric Paris <eparis@...hat.com>,
        Kefeng Wang <wangkefeng.wang@...wei.com>
Subject: Re: [Question] audit_names use after delete in audit_filter_inodes

On Thu, Aug 22, 2019 at 3:22 AM Chen Wandun <chenwandun@...wei.com> wrote:
> On 2019/8/21 23:36, Paul Moore wrote:
> > On Wed, Aug 21, 2019 at 5:31 AM Chen Wandun <chenwandun@...wei.com> wrote:
> >>
> >> Hi,
> >> Recently, I hit a use after delete in audit_filter_inodes,
> >
> > ...
> >
> >> the call stack is below:
> >> [321315.077117] CPU: 6 PID: 8944 Comm: DefSch0100 Tainted: G           OE  ----V-------   3.10.0-327.62.59.83.w75.x86_64 #1
> >> [321315.077117] Hardware name: OpenStack Foundation OpenStack Nova, BIOS rel-1.8.1-0-g4adadbd-20170107_142945-9_64_246_229 04/01/2014
> >
> > It looks like this is a vendor kernel and not an upstream kernel, yes?
>
> I analysed the upstream kernel about audit, and found there is no significant change
> in audit_names add/read/delete since v3.10.

The number of changes in a Linux v3.10 based distro kernel and a
modern upstream are quite significant, regardless of what you might
see by comparing a limited number of functions/structs.  I once again
suggest you contact your distribution provider for support, or move to
a modern Linux kernel so that upstream can better understand your
problem.

-- 
paul moore
www.paul-moore.com