On Tue, Jul 28, 2026 at 3:53 PM Paul Moore <[email protected]> wrote: > > On Jul 28, 2026 Ricardo Robaina <[email protected]> wrote: > > > > The BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS) check in > > audit_signal_info_syscall() will panic the kernel if the signal target > > pid array overflows, which is too severe for this situation. > > > > Replace it with a WARN_ON_ONCE() and return of -EINVAL, instead. > > > > Signed-off-by: Ricardo Robaina <[email protected]> > > --- > > kernel/auditsc.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > > index 6610e667c728..2b9ce0b52511 100644 > > --- a/kernel/auditsc.c > > +++ b/kernel/auditsc.c > > @@ -2712,7 +2712,8 @@ int audit_signal_info_syscall(struct task_struct *t) > > axp->d.next = ctx->aux_pids; > > ctx->aux_pids = (void *)axp; > > } > > - BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS); > > + if (WARN_ON_ONCE(axp->pid_count >= AUDIT_AUX_PIDS)) > > + return -EINVAL; > > Part of me wonders if the WARN_ON_ONCE() should be a pr_err(), possibly > ratelimited, but given that I don't recall ever seeing this BUG_ON() > trigger I think this is fine. We can always change the WARN_ON_ONCE() > later if needed, getting rid of the BUG_ON() is the big win. > > Merged into audit/dev, thanks.
Makes sense. Thanks, Paul! > > > axp->target_pid[axp->pid_count] = task_tgid_nr(t); > > axp->target_auid[axp->pid_count] = audit_get_loginuid(t); > > -- > > 2.53.0 > > -- > paul-moore.com >
