This patch series fixes a recursive locking deadlock in audit_dupe_exe() code path, as well as, a bug that prevents the deletion of dangling audit rules.
The first patch, simply removes the d_really_is_negative() check in audit_alloc_mark() to allow dummy mark allocation, fixing the -ENOENT failure when deleting dangling rules for unlinked executables. The second one, fixes the deadlock in audit_dupe_exe() by introducing the audit_watch_ctx struct to pass the fsnotify event context down the call chain. This safely bypasses the need for kern_path_parent() during move events, avoiding a double acquisition of the I_MUTEX_PARENT lock. Acked-by: Waiman Long <[email protected]> Acked-by: Richard Guy Briggs <[email protected]> Signed-off-by: Ricardo Robaina <[email protected]> --- Changes in v2: - Reordered patches - Refactored audit_alloc_mark() to eliminate code duplication by introducing local dir/child inode variables and unifying the critical execution path - Added allow_dups variable to preserve original behavior: manual rule additions use allow_dups=0 (no duplicates), fsnotify events use allow_dups=1 (allow temporary coexistence during rename) Ricardo Robaina (2): audit: fix removal of dangling executable rules audit: fix recursive locking deadlock in audit_dupe_exe() kernel/audit.h | 13 ++++++++++--- kernel/audit_fsnotify.c | 34 ++++++++++++++++++++++------------ kernel/audit_watch.c | 25 +++++++++++++++++-------- kernel/auditfilter.c | 9 +++++---- 4 files changed, 54 insertions(+), 27 deletions(-) -- 2.53.0
