On certain systems, in certain pathalogical cases, current's cwd can
be deleted while we're still processing a syscall. This should prevent
the system from evicting the inode while we're still referencing it.

This seems to fix the bug I reported here:
https://www.redhat.com/archives/linux-audit/2012-August/msg00017.html

Signed-off-by: Peter Moody <[email protected]>
---
 kernel/auditsc.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 4b96415..e86b8b9 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2064,6 +2064,7 @@ void __audit_getname(const char *name)
 
        if (!context->pwd.dentry)
                get_fs_pwd(current->fs, &context->pwd);
+       path_get(&context->pwd);
 }
 
 /* audit_putname - intercept a putname request
@@ -2091,6 +2092,7 @@ void audit_putname(const char *name)
                                       n->name, n->name ?: "(null)");
                        }
 #endif
+               path_put(&context->pwd);
                __putname(name);
        }
 #if AUDIT_DEBUG
-- 
1.7.7.3

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

Reply via email to