On Sep 22, 2026 =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= <[email protected]> wrote: > > kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit > tree is pruned. It drops entry->rule.exe before removing the rule from > the RCU-visible filter lists. > > After a rule has been installed with AUDIT_ADD_RULE, which requires > CAP_AUDIT_CONTROL, removing the watched directory can race with another > task that is still evaluating the rule. In that case, fsnotify can free > the executable mark before the reader reaches audit_mark_compare(), > causing a use-after-free. > > KASAN reports: > > BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0 > > Unlink the published rules from the RCU-visible lists and retain them > on tree->rules for cleanup. If any rule has an executable mark, wait for > a single RCU grace period before removing the marks and scheduling the > entries for freeing. Otherwise, call_rcu() already provides the required > deferred freeing without a synchronous wait. > > Fixes: 34d99af52ad4 ("audit: implement audit by executable") > Assisted-by: Codex:gpt-5 > Signed-off-by: Jérémy Jean <[email protected]> > Reviewed-by: Ricardo Robaina <[email protected]> > Tested-by: Ricardo Robaina <[email protected]> > Reviewed-by: Bradley Morgan <[email protected]> > --- > v2: Address Sashiko's review with Ricardo Robaina's improved patch: > - Batch executable-mark teardown behind one synchronize_rcu() after > unlinking all rules, instead of waiting once per rule under the audit > mutexes. > - Skip the synchronous wait when none of the removed rules has an > executable mark. > > v1: > https://lore.kernel.org/all/[email protected]/ > > kernel/audit_tree.c | 24 ++++++++++++++++++++---- > 1 file changed, 20 insertions(+), 4 deletions(-)
Merged into audit/stable-7.3 with a stable tag, I'll send this up to Linus next week after it has had some time in linux-next. Thanks! -- paul-moore.com
