Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a1b5bcff authored by Yi Wang's avatar Yi Wang Committed by Greg Kroah-Hartman
Browse files

audit: fix potential null dereference 'context->module.name' 



commit b305f7ed upstream.

The variable 'context->module.name' may be null pointer when
kmalloc return null, so it's better to check it before using
to avoid null dereference.
Another one more thing this patch does is using kstrdup instead
of (kmalloc + strcpy), and signal a lost record via audit_log_lost.

Cc: stable@vger.kernel.org # 4.11
Signed-off-by: default avatarYi Wang <wang.yi59@zte.com.cn>
Reviewed-by: default avatarJiang Biao <jiang.biao2@zte.com.cn>
Reviewed-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e5a16c6a

kernel/auditsc.c

+9 −4
Original line number Diff line number Diff line
@@ -1274,8 +1274,12 @@ static void show_special(struct audit_context *context, int *call_panic) 
		break;

	case AUDIT_KERN_MODULE:

		audit_log_format(ab, "name=");

		if (context->module.name) {

			audit_log_untrustedstring(ab, context->module.name);

			kfree(context->module.name);

		} else

			audit_log_format(ab, "(null)");



		break;

	}

	audit_log_end(ab);
@@ -2387,8 +2391,9 @@ void __audit_log_kern_module(char *name) 
{

	struct audit_context *context = current->audit_context;



	context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL);

	strcpy(context->module.name, name);

	context->module.name = kstrdup(name, GFP_KERNEL);

	if (!context->module.name)

		audit_log_lost("out of memory in __audit_log_kern_module");

	context->type = AUDIT_KERN_MODULE;

}