Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bd120ded authored by Elena Reshetova's avatar Elena Reshetova Committed by Paul Moore
Browse files

audit: convert audit_watch.count from atomic_t to refcount_t 



refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarHans Liljestrand <ishkamiel@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid Windsor <dwindsor@gmail.com>
[PM: fix subject line, add #include]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 9d2378f8

kernel/audit_watch.c

+5 −4
Original line number Diff line number Diff line
@@ -28,6 +28,7 @@ 
#include <linux/fsnotify_backend.h>

#include <linux/namei.h>

#include <linux/netlink.h>

#include <linux/refcount.h>

#include <linux/sched.h>

#include <linux/slab.h>

#include <linux/security.h>
@@ -46,7 +47,7 @@ 
 */



struct audit_watch {

	atomic_t		count;	/* reference count */

	refcount_t		count;	/* reference count */

	dev_t			dev;	/* associated superblock device */

	char			*path;	/* insertion path */

	unsigned long		ino;	/* associated inode number */
@@ -111,12 +112,12 @@ static inline struct audit_parent *audit_find_parent(struct inode *inode) 


void audit_get_watch(struct audit_watch *watch)

{

	atomic_inc(&watch->count);

	refcount_inc(&watch->count);

}



void audit_put_watch(struct audit_watch *watch)

{

	if (atomic_dec_and_test(&watch->count)) {

	if (refcount_dec_and_test(&watch->count)) {

		WARN_ON(watch->parent);

		WARN_ON(!list_empty(&watch->rules));

		kfree(watch->path);
@@ -178,7 +179,7 @@ static struct audit_watch *audit_init_watch(char *path) 
		return ERR_PTR(-ENOMEM);



	INIT_LIST_HEAD(&watch->rules);

	atomic_set(&watch->count, 1);

	refcount_set(&watch->count, 1);

	watch->path = path;

	watch->dev = AUDIT_DEV_UNSET;

	watch->ino = AUDIT_INO_UNSET;