Commit d76036ab authored Aug 15, 2017 by Jan Kara Committed by Paul Moore Aug 15, 2017

audit: Fix use after free in audit_remove_watch_rule()



audit_remove_watch_rule() drops watch's reference to parent but then
continues to work with it. That is not safe as parent can get freed once
we drop our reference. The following is a trivial reproducer:

mount -o loop image /mnt
touch /mnt/file
auditctl -w /mnt/file -p wax
umount /mnt
auditctl -D
<crash in fsnotify_destroy_mark()>

Grab our own reference in audit_remove_watch_rule() earlier to make sure
mark does not get freed under us.

CC: stable@vger.kernel.org
Reported-by: Tony Jones <tonyj@suse.de>
Signed-off-by: Jan Kara <jack@suse.cz>
Tested-by: Tony Jones <tonyj@suse.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>

parent b0659ae5

kernel/audit_watch.c

+7 −5

Original line number	Diff line number	Diff line
		@@ -457,15 +457,17 @@ void audit_remove_watch_rule(struct audit_krule *krule)
		list_del(&krule->rlist);

		if (list_empty(&watch->rules)) {
		audit_remove_watch(watch);

		if (list_empty(&parent->watches)) {
		/*
		* audit_remove_watch() drops our reference to 'parent' which
		* can get freed. Grab our own reference to be safe.
		*/
		audit_get_parent(parent);
		audit_remove_watch(watch);
		if (list_empty(&parent->watches))
		fsnotify_destroy_mark(&parent->mark, audit_watch_group);
		audit_put_parent(parent);
		}
		}
		}

		/* Update watch data in audit rules based on fsnotify events. */
		static int audit_watch_handle_event(struct fsnotify_group *group,