Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f3298dc4 authored by Al Viro's avatar Al Viro
Browse files

sanitize audit_socketcall 



* don't bother with allocations
* now that it can't fail, make it return void

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 4f6b434f

include/linux/audit.h

+2 −2
Original line number Diff line number Diff line
@@ -446,7 +446,7 @@ extern void audit_log_task_context(struct audit_buffer *ab); 
extern int __audit_ipc_obj(struct kern_ipc_perm *ipcp);

extern int __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode);

extern int audit_bprm(struct linux_binprm *bprm);

extern int audit_socketcall(int nargs, unsigned long *args);

extern void audit_socketcall(int nargs, unsigned long *args);

extern int audit_sockaddr(int len, void *addr);

extern int __audit_fd_pair(int fd1, int fd2);

extern int audit_set_macxattr(const char *name);
@@ -549,7 +549,7 @@ extern int audit_signals; 
#define audit_ipc_obj(i) ({ 0; })

#define audit_ipc_set_perm(q,u,g,m) ({ 0; })

#define audit_bprm(p) ({ 0; })

#define audit_socketcall(n,a) ({ 0; })

#define audit_socketcall(n,a) ((void)0)

#define audit_fd_pair(n,a) ({ 0; })

#define audit_sockaddr(len, addr) ({ 0; })

#define audit_set_macxattr(n) do { ; } while (0)

kernel/auditsc.c

+38 −28
Original line number Diff line number Diff line
@@ -168,12 +168,6 @@ struct audit_aux_data_execve { 
	struct mm_struct *mm;

};



struct audit_aux_data_socketcall {

	struct audit_aux_data	d;

	int			nargs;

	unsigned long		args[0];

};



struct audit_aux_data_fd_pair {

	struct	audit_aux_data d;

	int	fd[2];
@@ -247,6 +241,14 @@ struct audit_context { 
	struct audit_tree_refs *trees, *first_trees;

	int tree_count;



	int type;

	union {

		struct {

			int nargs;

			long args[6];

		} socketcall;

	};



#if AUDIT_DEBUG

	int		    put_count;

	int		    ino_count;
@@ -1226,6 +1228,27 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name) 
		audit_log_format(ab, " cap_fe=%d cap_fver=%x", name->fcap.fE, name->fcap_ver);

}



static void show_special(struct audit_context *context)

{

	struct audit_buffer *ab;

	int i;



	ab = audit_log_start(context, GFP_KERNEL, context->type);

	if (!ab)

		return;



	switch (context->type) {

	case AUDIT_SOCKETCALL: {

		int nargs = context->socketcall.nargs;

		audit_log_format(ab, "nargs=%d", nargs);

		for (i = 0; i < nargs; i++)

			audit_log_format(ab, " a%d=%lx", i,

				context->socketcall.args[i]);

		break; }

	}

	audit_log_end(ab);

}



static void audit_log_exit(struct audit_context *context, struct task_struct *tsk)

{

	const struct cred *cred;
@@ -1372,13 +1395,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts 
			audit_log_execve_info(context, &ab, axi);

			break; }



		case AUDIT_SOCKETCALL: {

			struct audit_aux_data_socketcall *axs = (void *)aux;

			audit_log_format(ab, "nargs=%d", axs->nargs);

			for (i=0; i<axs->nargs; i++)

				audit_log_format(ab, " a%d=%lx", i, axs->args[i]);

			break; }



		case AUDIT_FD_PAIR: {

			struct audit_aux_data_fd_pair *axs = (void *)aux;

			audit_log_format(ab, "fd0=%d fd1=%d", axs->fd[0], axs->fd[1]);
@@ -1410,6 +1426,9 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts 
		audit_log_end(ab);

	}



	if (context->type)

		show_special(context);



	if (context->sockaddr_len) {

		ab = audit_log_start(context, GFP_KERNEL, AUDIT_SOCKADDR);

		if (ab) {
@@ -1689,6 +1708,7 @@ void audit_syscall_exit(int valid, long return_code) 
		context->target_pid = 0;

		context->target_sid = 0;

		context->sockaddr_len = 0;

		context->type = 0;

		kfree(context->filterkey);

		context->filterkey = NULL;

		tsk->audit_context = context;
@@ -2406,27 +2426,17 @@ int audit_bprm(struct linux_binprm *bprm) 
 * @nargs: number of args

 * @args: args array

 *

 * Returns 0 for success or NULL context or < 0 on error.

 */

int audit_socketcall(int nargs, unsigned long *args)

void audit_socketcall(int nargs, unsigned long *args)

{

	struct audit_aux_data_socketcall *ax;

	struct audit_context *context = current->audit_context;



	if (likely(!context || context->dummy))

		return 0;



	ax = kmalloc(sizeof(*ax) + nargs * sizeof(unsigned long), GFP_KERNEL);

	if (!ax)

		return -ENOMEM;



	ax->nargs = nargs;

	memcpy(ax->args, args, nargs * sizeof(unsigned long));

		return;



	ax->d.type = AUDIT_SOCKETCALL;

	ax->d.next = context->aux;

	context->aux = (void *)ax;

	return 0;

	context->type = AUDIT_SOCKETCALL;

	context->socketcall.nargs = nargs;

	memcpy(context->socketcall.args, args, nargs * sizeof(unsigned long));

}



/**

net/socket.c

+1 −3
Original line number Diff line number Diff line
@@ -2065,9 +2065,7 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args) 
	if (copy_from_user(a, args, nargs[call]))

		return -EFAULT;



	err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);

	if (err)

		return err;

	audit_socketcall(nargs[call] / sizeof(unsigned long), a);



	a0 = a[0];

	a1 = a[1];