Re: [PATCH 2/2] audit: drop BUG_ON() from audit_signal_info_syscall()

[Ricardo Robaina]

On Tue, Jul 28, 2026 at 3:53 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
>
> On Jul 28, 2026 Ricardo Robaina <rrobaina@xxxxxxxxxx> wrote:
> >
> > The BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS) check in
> > audit_signal_info_syscall() will panic the kernel if the signal target
> > pid array overflows, which is too severe for this situation.
> >
> > Replace it with a WARN_ON_ONCE() and return of -EINVAL, instead.
> >
> > Signed-off-by: Ricardo Robaina <rrobaina@xxxxxxxxxx>
> > ---
> >  kernel/auditsc.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> > index 6610e667c728..2b9ce0b52511 100644
> > --- a/kernel/auditsc.c
> > +++ b/kernel/auditsc.c
> > @@ -2712,7 +2712,8 @@ int audit_signal_info_syscall(struct task_struct *t)
> >               axp->d.next = ctx->aux_pids;
> >               ctx->aux_pids = (void *)axp;
> >       }
> > -     BUG_ON(axp->pid_count >= AUDIT_AUX_PIDS);
> > +     if (WARN_ON_ONCE(axp->pid_count >= AUDIT_AUX_PIDS))
> > +             return -EINVAL;
>
> Part of me wonders if the WARN_ON_ONCE() should be a pr_err(), possibly
> ratelimited, but given that I don't recall ever seeing this BUG_ON()
> trigger I think this is fine.  We can always change the WARN_ON_ONCE()
> later if needed, getting rid of the BUG_ON() is the big win.
>
> Merged into audit/dev, thanks.

Makes sense. Thanks, Paul!

>
> >       axp->target_pid[axp->pid_count] = task_tgid_nr(t);
> >       axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
> > --
> > 2.53.0
>
> --
> paul-moore.com
>