During a queue overflow condition while we are waiting for auditd to drain the queue to make room for regular messages, we don't want a successful auditd that has bypassed the queue check to reset the backlog wait time.
Signed-off-by: Richard Guy Briggs <[email protected]> --- kernel/audit.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index b333f03..73293ea 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1395,7 +1395,8 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, return NULL; } - audit_backlog_wait_time = audit_backlog_wait_time_master; + if (!reserve) + audit_backlog_wait_time = audit_backlog_wait_time_master; ab = audit_buffer_alloc(ctx, gfp_mask, type); if (!ab) { -- 1.7.1 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
