Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1717750

[PATCH 4.12 01/41] audit: Fix use after free in audit_remove_watch_rule()

Show all headers | View raw

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Kara <jack@suse.cz>

commit d76036ab47eafa6ce52b69482e91ca3ba337d6d6 upstream.

audit_remove_watch_rule() drops watch's reference to parent but then
continues to work with it. That is not safe as parent can get freed once
we drop our reference. The following is a trivial reproducer:

mount -o loop image /mnt
touch /mnt/file
auditctl -w /mnt/file -p wax
umount /mnt
auditctl -D
<crash in fsnotify_destroy_mark()>

Grab our own reference in audit_remove_watch_rule() earlier to make sure
mark does not get freed under us.

Reported-by: Tony Jones <tonyj@suse.de>
Signed-off-by: Jan Kara <jack@suse.cz>
Tested-by: Tony Jones <tonyj@suse.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/audit_watch.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -457,13 +457,15 @@ void audit_remove_watch_rule(struct audi
 	list_del(&krule->rlist);
 
 	if (list_empty(&watch->rules)) {
+		/*
+		 * audit_remove_watch() drops our reference to 'parent' which
+		 * can get freed. Grab our own reference to be safe.
+		 */
+		audit_get_parent(parent);
 		audit_remove_watch(watch);
-
-		if (list_empty(&parent->watches)) {
-			audit_get_parent(parent);
+		if (list_empty(&parent->watches))
 			fsnotify_destroy_mark(&parent->mark, audit_watch_group);
-			audit_put_parent(parent);
-		}
+		audit_put_parent(parent);
 	}
 }
 

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.12 00/41] 4.12.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 28/41] perf/x86: Fix RDPMC vs. mm_struct tracking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 09/41] md: fix test in md_write_start() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 31/41] x86/elf: Remove the unnecessary ADDR_NO_RANDOMIZE checks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 19/41] mm/cma_debug.c: fix stack corruption due to sprintf usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 21/41] mm/vmalloc.c: dont unconditonally use __GFP_HIGHMEM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 02/41] parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 10/41] md: always clear ->safemode when md_check_recovery gets the mddev lock. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 25/41] blk-mq-pci: add a fallback when pci_irq_get_affinity returns NULL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 05/41] drm/i915: Perform an invalidate prior to executing golden renderstate Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 22/41] mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 01/41] audit: Fix use after free in audit_remove_watch_rule() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 27/41] xen-blkfront: use a right index when checking requests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 18/41] mm: fix double mmap_sem unlock on MMF_UNSTABLE enforced SIGBUS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 32/41] irqchip/atmel-aic: Fix unbalanced of_node_put() in aic_common_irq_fixup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  [PATCH 4.12 29/41] x86/asm/64: Clear AC on NMI entries Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-22 21:30 +0200
  Re: [PATCH 4.12 00/41] 4.12.9-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-08-23 02:40 +0200
    Re: [PATCH 4.12 00/41] 4.12.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-23 02:50 +0200

csiph-web