aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJan Kara2017-08-15 06:00:36 -0500
committerGreg Kroah-Hartman2017-08-24 19:02:35 -0500
commitea088172692cbadddc4efcdae2a5dfe1693e8b20 (patch)
tree1c93ef90178f4644afaf15d173cd992c1423e119
parentb72f1119c654a2e3aeb41175ff94299a4ec01afb (diff)
downloadkernel-omap-ea088172692cbadddc4efcdae2a5dfe1693e8b20.tar.gz
kernel-omap-ea088172692cbadddc4efcdae2a5dfe1693e8b20.tar.xz
kernel-omap-ea088172692cbadddc4efcdae2a5dfe1693e8b20.zip
audit: Fix use after free in audit_remove_watch_rule()
commit d76036ab47eafa6ce52b69482e91ca3ba337d6d6 upstream. audit_remove_watch_rule() drops watch's reference to parent but then continues to work with it. That is not safe as parent can get freed once we drop our reference. The following is a trivial reproducer: mount -o loop image /mnt touch /mnt/file auditctl -w /mnt/file -p wax umount /mnt auditctl -D <crash in fsnotify_destroy_mark()> Grab our own reference in audit_remove_watch_rule() earlier to make sure mark does not get freed under us. Reported-by: Tony Jones <tonyj@suse.de> Signed-off-by: Jan Kara <jack@suse.cz> Tested-by: Tony Jones <tonyj@suse.de> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--kernel/audit_watch.c12
1 files changed, 7 insertions, 5 deletions
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index 939945a5649c..a162661c9d60 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -457,13 +457,15 @@ void audit_remove_watch_rule(struct audit_krule *krule)
457 list_del(&krule->rlist); 457 list_del(&krule->rlist);
458 458
459 if (list_empty(&watch->rules)) { 459 if (list_empty(&watch->rules)) {
460 /*
461 * audit_remove_watch() drops our reference to 'parent' which
462 * can get freed. Grab our own reference to be safe.
463 */
464 audit_get_parent(parent);
460 audit_remove_watch(watch); 465 audit_remove_watch(watch);
461 466 if (list_empty(&parent->watches))
462 if (list_empty(&parent->watches)) {
463 audit_get_parent(parent);
464 fsnotify_destroy_mark(&parent->mark, audit_watch_group); 467 fsnotify_destroy_mark(&parent->mark, audit_watch_group);
465 audit_put_parent(parent); 468 audit_put_parent(parent);
466 }
467 } 469 }
468} 470}
469 471