[PATCH] [XFRM] AUDIT: Fix audit buffer leakage in error path.

[PATCH] [XFRM] AUDIT: Fix audit buffer leakage in error path.

[YOSHIFUJI Hideaki / 吉藤英明]

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b7e537f..af85ac9 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1999,7 +1999,7 @@ void xfrm_audit_log(uid_t auid, u32 sid, int type, int result,
 
 	audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, type);
 	if (audit_buf == NULL)
-	return;
+		return;
 
 	switch(type) {
 	case AUDIT_MAC_IPSEC_ADDSA:
@@ -2015,7 +2015,7 @@ void xfrm_audit_log(uid_t auid, u32 sid, int type, int result,
 		audit_log_format(audit_buf, "SPD delete: auid=%u", auid);
 		break;
 	default:
-		return;
+		goto out;
 	}
 
 	if (sid != 0 &&
@@ -2085,6 +2085,7 @@ void xfrm_audit_log(uid_t auid, u32 sid, int type, int result,
 				"ESP" : "IPCOMP"));
 
 	audit_log_format(audit_buf, " res=%u", result);
+out:
 	audit_log_end(audit_buf);
 }
 

-- 
YOSHIFUJI Hideaki @ USAGI Project  <yoshfuji@linux-ipv6.org>
GPG-FP  : 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA

Re: [PATCH] [XFRM] AUDIT: Fix audit buffer leakage in error path.

[David Miller]

From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Date: Tue, 13 Feb 2007 00:34:29 +0900 (JST)

> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

Oh yes.  I noticed this too while working with Joy Latten's OOPS fix
for this function.

Event types other than those 4 mentioned in the switch() statement are
illegal and should never be passed in.  It is probably better to BUG()
on this situation rather than try to handle the log buffer leakage.

Re: [PATCH] [XFRM] AUDIT: Fix audit buffer leakage in error path.

[YOSHIFUJI Hideaki / 吉藤英明]

In article <20070212.152317.92582928.davem@davemloft.net> (at Mon, 12 Feb 2007 15:23:17 -0800 (PST)), David Miller <davem@davemloft.net> says:

> From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
> Date: Tue, 13 Feb 2007 00:34:29 +0900 (JST)
> 
> > Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
> 
> Oh yes.  I noticed this too while working with Joy Latten's OOPS fix
> for this function.
> 
> Event types other than those 4 mentioned in the switch() statement are
> illegal and should never be passed in.  It is probably better to BUG()
> on this situation rather than try to handle the log buffer leakage.

Okay, I agree and I withdraw my patch.

--yoshfuji