Re: [RFC PATCH v3] audit: use proper refcount locking on audit_sock

From: Paul Moore
Date: Tue Dec 13 2016 - 15:51:35 EST

On Tue, Dec 13, 2016 at 10:03 AM, Richard Guy Briggs <rgb@xxxxxxxxxx> wrote:
> Resetting audit_sock appears to be racy.
> audit_sock was being copied and dereferenced without using a refcount on
> the source sock.
> Bump the refcount on the underlying sock when we store a refrence in
> audit_sock and release it when we reset audit_sock. audit_sock
> modification needs the audit_cmd_mutex.
> See:
> Thanks to Eric Dumazet <edumazet@xxxxxxxxxx> and Cong Wang
> <xiyou.wangcong@xxxxxxxxx> on ideas how to fix it.
> Signed-off-by: Richard Guy Briggs <rgb@xxxxxxxxxx>
> ---
> There has been a lot of change in the audit code that is about to go
> upstream to address audit queue issues. This patch is based on the
> source tree: git://
> ---
> kernel/audit.c | 28 +++++++++++++++++++++++-----
> 1 files changed, 23 insertions(+), 5 deletions(-)

This looks more reasonable. I still wonder about synchronization
between threads changing the audit_* connection variables and the
kauditd_thread, but I guess we can treat that as another issue; this
patch fixes a bug and is worth merging now.

I'm building a test kernel right now, assuming nothing blows up I'll
push this patch with the rest of the audit patches tomorrow; if
something bad happens, this is going to miss the first audit pull

> diff --git a/kernel/audit.c b/kernel/audit.c
> index f20eee0..3bb4126 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -446,14 +446,19 @@ static void kauditd_retry_skb(struct sk_buff *skb)
> * Description:
> * Break the auditd/kauditd connection and move all the records in the retry
> * queue into the hold queue in case auditd reconnects.
> + * The audit_cmd_mutex must be held when calling this function.
> */

Don't resend, but in the future please start comments like this on the
previous line.