lkml.org 
[lkml]   [2018]   [Aug]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.17 21/31] audit: fix potential null dereference context->module.name
    Date
    4.17-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Yi Wang <wang.yi59@zte.com.cn>

    commit b305f7ed0f4f494ad6f3ef5667501535d5a8fa31 upstream.

    The variable 'context->module.name' may be null pointer when
    kmalloc return null, so it's better to check it before using
    to avoid null dereference.
    Another one more thing this patch does is using kstrdup instead
    of (kmalloc + strcpy), and signal a lost record via audit_log_lost.

    Cc: stable@vger.kernel.org # 4.11
    Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
    Reviewed-by: Jiang Biao <jiang.biao2@zte.com.cn>
    Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    kernel/auditsc.c | 13 +++++++++----
    1 file changed, 9 insertions(+), 4 deletions(-)

    --- a/kernel/auditsc.c
    +++ b/kernel/auditsc.c
    @@ -1274,8 +1274,12 @@ static void show_special(struct audit_co
    break;
    case AUDIT_KERN_MODULE:
    audit_log_format(ab, "name=");
    - audit_log_untrustedstring(ab, context->module.name);
    - kfree(context->module.name);
    + if (context->module.name) {
    + audit_log_untrustedstring(ab, context->module.name);
    + kfree(context->module.name);
    + } else
    + audit_log_format(ab, "(null)");
    +
    break;
    }
    audit_log_end(ab);
    @@ -2408,8 +2412,9 @@ void __audit_log_kern_module(char *name)
    {
    struct audit_context *context = current->audit_context;

    - context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL);
    - strcpy(context->module.name, name);
    + context->module.name = kstrdup(name, GFP_KERNEL);
    + if (!context->module.name)
    + audit_log_lost("out of memory in __audit_log_kern_module");
    context->type = AUDIT_KERN_MODULE;
    }


    \
     
     \ /
      Last update: 2018-08-04 11:23    [W:4.392 / U:0.240 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site