On Mon, Feb 24, 2020 at 4:31 PM Paul Moore <p...@paul-moore.com> wrote: > > Commit 219ca39427bf ("audit: use union for audit_field values since > they are mutually exclusive") combined a number of separate fields in > the audit_field struct into a single union. Generally this worked > just fine because they are generally mutually exclusive. > Unfortunately in audit_data_to_entry() the overlap can be a problem > when a specific error case is triggered that causes the error path > code to attempt to cleanup an audit_field struct and the cleanup > involves attempting to free a stored LSM string (the lsm_str field). > Currently the code always has a non-NULL value in the > audit_field.lsm_str field as the top of the for-loop transfers a > value into audit_field.val (both .lsm_str and .val are part of the > same union); if audit_data_to_entry() fails and the audit_field > struct is specified to contain a LSM string, but the > audit_field.lsm_str has not yet been properly set, the error handling > code will attempt to free the bogus audit_field.lsm_str value that > was set with audit_field.val at the top of the for-loop. > > This patch corrects this by ensuring that the audit_field.val is only > set when needed (it is cleared when the audit_field struct is > allocated with kcalloc()). It also corrects a few other issues to > ensure that in case of error the proper error code is returned. > > Cc: sta...@vger.kernel.org > Fixes: 219ca39427bf ("audit: use union for audit_field values since they are > mutually exclusive") > Reported-by: syzbot+1f4d90ead370d72e4...@syzkaller.appspotmail.com > Signed-off-by: Paul Moore <p...@paul-moore.com> > --- > kernel/auditfilter.c | 71 > +++++++++++++++++++++++++++----------------------- > 1 file changed, 39 insertions(+), 32 deletions(-)
Merged into audit/stable-5.6, assuming there are no problems I'll send it up to Linus later this week. -- paul moore www.paul-moore.com -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit