On Mon, Feb 24, 2020 at 4:31 PM Paul Moore <[email protected]> wrote: > > Commit 219ca39427bf ("audit: use union for audit_field values since > they are mutually exclusive") combined a number of separate fields in > the audit_field struct into a single union. Generally this worked > just fine because they are generally mutually exclusive. > Unfortunately in audit_data_to_entry() the overlap can be a problem > when a specific error case is triggered that causes the error path > code to attempt to cleanup an audit_field struct and the cleanup > involves attempting to free a stored LSM string (the lsm_str field). > Currently the code always has a non-NULL value in the > audit_field.lsm_str field as the top of the for-loop transfers a > value into audit_field.val (both .lsm_str and .val are part of the > same union); if audit_data_to_entry() fails and the audit_field > struct is specified to contain a LSM string, but the > audit_field.lsm_str has not yet been properly set, the error handling > code will attempt to free the bogus audit_field.lsm_str value that > was set with audit_field.val at the top of the for-loop. > > This patch corrects this by ensuring that the audit_field.val is only > set when needed (it is cleared when the audit_field struct is > allocated with kcalloc()). It also corrects a few other issues to > ensure that in case of error the proper error code is returned. > > Cc: [email protected] > Fixes: 219ca39427bf ("audit: use union for audit_field values since they are > mutually exclusive") > Reported-by: [email protected] > Signed-off-by: Paul Moore <[email protected]> > --- > kernel/auditfilter.c | 71 > +++++++++++++++++++++++++++----------------------- > 1 file changed, 39 insertions(+), 32 deletions(-)
Merged into audit/stable-5.6, assuming there are no problems I'll send it up to Linus later this week. -- paul moore www.paul-moore.com -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
