Skip to content

Commit

Permalink
audit: fix potential null dereference 'context->module.name'
Browse files Browse the repository at this point in the history
The variable 'context->module.name' may be null pointer when
kmalloc return null, so it's better to check it before using
to avoid null dereference.
Another one more thing this patch does is using kstrdup instead
of (kmalloc + strcpy), and signal a lost record via audit_log_lost.

Cc: stable@vger.kernel.org # 4.11
Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
Reviewed-by: Jiang Biao <jiang.biao2@zte.com.cn>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
  • Loading branch information
Yi Wang authored and pcmoore committed Jul 30, 2018
1 parent 5b71388 commit b305f7e
Showing 1 changed file with 9 additions and 4 deletions.
13 changes: 9 additions & 4 deletions kernel/auditsc.c
Original file line number Diff line number Diff line change
Expand Up @@ -1279,8 +1279,12 @@ static void show_special(struct audit_context *context, int *call_panic)
break;
case AUDIT_KERN_MODULE:
audit_log_format(ab, "name=");
audit_log_untrustedstring(ab, context->module.name);
kfree(context->module.name);
if (context->module.name) {
audit_log_untrustedstring(ab, context->module.name);
kfree(context->module.name);
} else
audit_log_format(ab, "(null)");

break;
}
audit_log_end(ab);
Expand Down Expand Up @@ -2411,8 +2415,9 @@ void __audit_log_kern_module(char *name)
{
struct audit_context *context = audit_context();

context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL);
strcpy(context->module.name, name);
context->module.name = kstrdup(name, GFP_KERNEL);
if (!context->module.name)
audit_log_lost("out of memory in __audit_log_kern_module");
context->type = AUDIT_KERN_MODULE;
}

Expand Down

0 comments on commit b305f7e

Please sign in to comment.