Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759751AbYA1LKd (ORCPT ); Mon, 28 Jan 2008 06:10:33 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751574AbYA1LK0 (ORCPT ); Mon, 28 Jan 2008 06:10:26 -0500 Received: from rhun.apana.org.au ([64.62.148.172]:49478 "EHLO arnor.apana.org.au" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751227AbYA1LKZ (ORCPT ); Mon, 28 Jan 2008 06:10:25 -0500 Date: Mon, 28 Jan 2008 22:10:18 +1100 From: Herbert Xu To: Linus Torvalds , Andrew Morton , "David S. Miller" , Linux Kernel Mailing List Subject: [AUDIT]: Increase skb->truesize in audit_expand Message-ID: <20080128111018.GA6442@gondor.apana.org.au> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.13 (2006-08-11) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1731 Lines: 52 Hi: [AUDIT]: Increase skb->truesize in audit_expand The recent UDP patch exposed this bug in the audit code. It was calling pskb_expand_head without increasing skb->truesize. The caller of pskb_expand_head needs to do so because that function is designed to be called in places where truesize is already fixed and therefore it doesn't update its value. Because the audit system is using it in a place where the truesize has not yet been fixed, it needs to update its value manually. Signed-off-by: Herbert Xu Cheers, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt -- diff --git a/kernel/audit.c b/kernel/audit.c index f93c271..801c946 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1200,13 +1200,17 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, static inline int audit_expand(struct audit_buffer *ab, int extra) { struct sk_buff *skb = ab->skb; - int ret = pskb_expand_head(skb, skb_headroom(skb), extra, - ab->gfp_mask); + int oldtail = skb_tailroom(skb); + int ret = pskb_expand_head(skb, 0, extra, ab->gfp_mask); + int newtail = skb_tailroom(skb); + if (ret < 0) { audit_log_lost("out of memory in audit_expand"); return 0; } - return skb_tailroom(skb); + + skb->truesize += newtail - oldtail; + return newtail; } /* -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/