Commit 3ea67c4f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'audit-pr-20230829' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit 

Pull audit updates from Paul Moore:
 "Six audit patches, the highlights are:

   - Add an explicit cond_resched() call when generating PATH records

     Certain tracefs/debugfs operations can generate a *lot* of audit
     PATH entries and if one has an aggressive system configuration (not
     the default) this can cause a soft lockup in the audit code as it
     works to process all of these new entries.

     This is in sharp contrast to the common case where only one or two
     PATH entries are logged. In order to fix this corner case without
     excessively impacting the common case we're adding a single
     cond_rescued() call between two of the most intensive loops in the
     __audit_inode_child() function.

   - Various minor cleanups

     We removed a conditional header file as the included header already
     had the necessary logic in place, fixed a dummy function's return
     value, and the usual collection of checkpatch.pl noise (whitespace,
     brace, and trailing statement tweaks)"

* tag 'audit-pr-20230829' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: move trailing statements to next line
  audit: cleanup function braces and assignment-in-if-condition
  audit: add space before parenthesis and around '=', "==", and '<'
  audit: fix possible soft lockup in __audit_inode_child()
  audit: correct audit_filter_inodes() definition
  audit: include security.h unconditionally
parents 6c1b980a b1a0f64c

kernel/audit.c

+2 −3
Original line number Original line Diff line number Diff line
@@ -53,9 +53,7 @@ 
#include <net/sock.h>

#include <net/sock.h>

#include <net/netlink.h>

#include <net/netlink.h>

#include <linux/skbuff.h>

#include <linux/skbuff.h>

#ifdef CONFIG_SECURITY

#include <linux/security.h>

#include <linux/security.h>

#endif

#include <linux/freezer.h>

#include <linux/freezer.h>

#include <linux/pid_namespace.h>

#include <linux/pid_namespace.h>

#include <net/netns/generic.h>

#include <net/netns/generic.h>
@@ -323,7 +321,8 @@ static inline int audit_rate_check(void) 
	unsigned long		now;

	unsigned long		now;

	int			retval	   = 0;

	int			retval	   = 0;





	if (!audit_rate_limit) return 1;

	if (!audit_rate_limit)

		return 1;





	spin_lock_irqsave(&lock, flags);

	spin_lock_irqsave(&lock, flags);

	if (++messages < audit_rate_limit) {

	if (++messages < audit_rate_limit) {

kernel/audit.h

+1 −1
Original line number Original line Diff line number Diff line
@@ -334,7 +334,7 @@ static inline int audit_signal_info_syscall(struct task_struct *t) 
	return 0;

	return 0;

}

}





#define audit_filter_inodes(t, c) AUDIT_STATE_DISABLED

#define audit_filter_inodes(t, c) do { } while (0)

#endif /* CONFIG_AUDITSYSCALL */

#endif /* CONFIG_AUDITSYSCALL */





extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);

extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);

kernel/auditfilter.c

+10 −9
Original line number Original line Diff line number Diff line
@@ -694,7 +694,8 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule) 
			data->values[i] = f->val;

			data->values[i] = f->val;

		}

		}

	}

	}

	for (i = 0; i < AUDIT_BITMASK_SIZE; i++) data->mask[i] = krule->mask[i];

	for (i = 0; i < AUDIT_BITMASK_SIZE; i++)

		data->mask[i] = krule->mask[i];





	return data;

	return data;

}

}

kernel/auditsc.c

+7 −3
Original line number Original line Diff line number Diff line
@@ -880,7 +880,8 @@ static void audit_filter_syscall(struct task_struct *tsk, 
 */

 */

static int audit_filter_inode_name(struct task_struct *tsk,

static int audit_filter_inode_name(struct task_struct *tsk,

				   struct audit_names *n,

				   struct audit_names *n,

				   struct audit_context *ctx) {

				   struct audit_context *ctx)

{

	int h = audit_hash_ino((u32)n->ino);

	int h = audit_hash_ino((u32)n->ino);

	struct list_head *list = &audit_inode_hash[h];

	struct list_head *list = &audit_inode_hash[h];
@@ -1064,7 +1065,8 @@ int audit_alloc(struct task_struct *tsk) 
		return 0;

		return 0;

	}

	}





	if (!(context = audit_alloc_context(state))) {

	context = audit_alloc_context(state);

	if (!context) {

		kfree(key);

		kfree(key);

		audit_log_lost("out of memory in audit_alloc");

		audit_log_lost("out of memory in audit_alloc");

		return -ENOMEM;

		return -ENOMEM;
@@ -2456,6 +2458,8 @@ void __audit_inode_child(struct inode *parent, 
		}

		}

	}

	}





	cond_resched();



	/* is there a matching child entry? */

	/* is there a matching child entry? */

	list_for_each_entry(n, &context->names_list, list) {

	list_for_each_entry(n, &context->names_list, list) {

		/* can only match entries that have a name */

		/* can only match entries that have a name */

kernel/acct.c

+1 −1

File changed.

Contains only whitespace changes.