Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S941091AbcLMUvc (ORCPT ); Tue, 13 Dec 2016 15:51:32 -0500 Received: from mail-vk0-f68.google.com ([209.85.213.68]:36502 "EHLO mail-vk0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S941068AbcLMUv0 (ORCPT ); Tue, 13 Dec 2016 15:51:26 -0500 MIME-Version: 1.0 X-Originating-IP: [96.230.190.88] In-Reply-To: <61c37ca790bc11bc023aea8f9b70ab3098aa30f5.1481626466.git.rgb@redhat.com> References: <20161212100215.GA1305@madcap2.tricolour.ca> <61c37ca790bc11bc023aea8f9b70ab3098aa30f5.1481626466.git.rgb@redhat.com> From: Paul Moore Date: Tue, 13 Dec 2016 15:50:18 -0500 Message-ID: Subject: Re: [RFC PATCH v3] audit: use proper refcount locking on audit_sock To: Richard Guy Briggs Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-audit@redhat.com, edumazet@google.com, xiyou.wangcong@gmail.com, dvyukov@google.com Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1913 Lines: 47 On Tue, Dec 13, 2016 at 10:03 AM, Richard Guy Briggs wrote: > Resetting audit_sock appears to be racy. > > audit_sock was being copied and dereferenced without using a refcount on > the source sock. > > Bump the refcount on the underlying sock when we store a refrence in > audit_sock and release it when we reset audit_sock. audit_sock > modification needs the audit_cmd_mutex. > > See: https://lkml.org/lkml/2016/11/26/232 > > Thanks to Eric Dumazet and Cong Wang > on ideas how to fix it. > > Signed-off-by: Richard Guy Briggs > --- > There has been a lot of change in the audit code that is about to go > upstream to address audit queue issues. This patch is based on the > source tree: git://git.infradead.org/users/pcmoore/audit#next > --- > kernel/audit.c | 28 +++++++++++++++++++++++----- > 1 files changed, 23 insertions(+), 5 deletions(-) This looks more reasonable. I still wonder about synchronization between threads changing the audit_* connection variables and the kauditd_thread, but I guess we can treat that as another issue; this patch fixes a bug and is worth merging now. I'm building a test kernel right now, assuming nothing blows up I'll push this patch with the rest of the audit patches tomorrow; if something bad happens, this is going to miss the first audit pull request. > diff --git a/kernel/audit.c b/kernel/audit.c > index f20eee0..3bb4126 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -446,14 +446,19 @@ static void kauditd_retry_skb(struct sk_buff *skb) > * Description: > * Break the auditd/kauditd connection and move all the records in the retry > * queue into the hold queue in case auditd reconnects. > + * The audit_cmd_mutex must be held when calling this function. > */ Don't resend, but in the future please start comments like this on the previous line.