Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 040b3a2d authored by Peter Zijlstra's avatar Peter Zijlstra Committed by Linus Torvalds
Browse files

audit: fix two bugs in the new execve audit code 



copy_from_user() returns the number of bytes not copied, hence 0 is the
expected output.

axi->mm might not be valid anymore when not equal to current->mm, do not
dereference before checking that - thanks to Al for spotting that.

Signed-off-by: default avatarPeter Zijlstra <a.p.zijlstra@chello.nl>
Tested-by: default avatarSteve Grubb <sgrubb@redhat.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 0af3678f

kernel/auditsc.c

+4 −2
Original line number Diff line number Diff line
@@ -824,12 +824,14 @@ static void audit_log_execve_info(struct audit_buffer *ab, 
{

	int i;

	long len, ret;

	const char __user *p = (const char __user *)axi->mm->arg_start;

	const char __user *p;

	char *buf;



	if (axi->mm != current->mm)

		return; /* execve failed, no additional info */



	p = (const char __user *)axi->mm->arg_start;



	for (i = 0; i < axi->argc; i++, p += len) {

		len = strnlen_user(p, MAX_ARG_STRLEN);

		/*
@@ -855,7 +857,7 @@ static void audit_log_execve_info(struct audit_buffer *ab, 
		 * copied them here, and the mm hasn't been exposed to user-

		 * space yet.

		 */

		if (!ret) {

		if (ret) {

			WARN_ON(1);

			send_sig(SIGKILL, current, 0);

		}