From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.3 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39934C433ED for ; Wed, 21 Apr 2021 19:07:48 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 9749661103 for ; Wed, 21 Apr 2021 19:07:47 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 9749661103 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=tempfail smtp.mailfrom=linux-audit-bounces@redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1619032066; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=ktXk/P74AoXVZT5MkQ5wrE2sYy2lDqvTJZO7cAyAo+Q=; b=K+yROZ1hDfcoCFTjJMnot6O4l4YWAR11Uj18gcZxMEFNV5doAcvx1dg606XozkPDn9cEFY 77c49pwNmTGxBR8VjiTYZ7AJc8Q9Q000HsiuiQZAx5GFBpJZT7rw/LISvbP+JZcU6rXF46 7yMqYy+LpKN3Uskr4UzQmAMsHQYh7Xw= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-587-uzy1nAayNgaigfyq1qLyvQ-1; Wed, 21 Apr 2021 15:07:44 -0400 X-MC-Unique: uzy1nAayNgaigfyq1qLyvQ-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 92920107ACCA; Wed, 21 Apr 2021 19:07:40 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id AD6C660C05; Wed, 21 Apr 2021 19:07:38 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 253161806D1A; Wed, 21 Apr 2021 19:07:36 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 13LJ7Ys3029815 for ; Wed, 21 Apr 2021 15:07:34 -0400 Received: by smtp.corp.redhat.com (Postfix) id 709B6503B9; Wed, 21 Apr 2021 19:07:34 +0000 (UTC) Received: from madcap2.tricolour.ca (unknown [10.10.110.24]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 7CF5A60C05; Wed, 21 Apr 2021 19:07:27 +0000 (UTC) Date: Wed, 21 Apr 2021 15:07:24 -0400 From: Richard Guy Briggs To: Paul Moore Subject: Re: [PATCH 085/190] Revert "audit: fix a memory leak bug" Message-ID: <20210421190724.GK3141668@madcap2.tricolour.ca> References: <20210421130105.1226686-1-gregkh@linuxfoundation.org> <20210421130105.1226686-86-gregkh@linuxfoundation.org> <20210421170257.GJ3141668@madcap2.tricolour.ca> MIME-Version: 1.0 In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-loop: linux-audit@redhat.com Cc: linux-audit@redhat.com X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Disposition: inline Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit On 2021-04-21 13:14, Paul Moore wrote: > On Wed, Apr 21, 2021 at 1:03 PM Richard Guy Briggs wrote: > > On 2021-04-21 12:18, Paul Moore wrote: > > > On Wed, Apr 21, 2021 at 9:04 AM Greg Kroah-Hartman > > > wrote: > > > > > > > > This reverts commit 70c4cf17e445264453bc5323db3e50aa0ac9e81f. > > > > > > > > Commits from @umn.edu addresses have been found to be submitted in "bad > > > > faith" to try to test the kernel community's ability to review "known > > > > malicious" changes. The result of these submissions can be found in a > > > > paper published at the 42nd IEEE Symposium on Security and Privacy > > > > entitled, "Open Source Insecurity: Stealthily Introducing > > > > Vulnerabilities via Hypocrite Commits" written by Qiushi Wu (University > > > > of Minnesota) and Kangjie Lu (University of Minnesota). > > > > > > > > Because of this, all submissions from this group must be reverted from > > > > the kernel tree and will need to be re-reviewed again to determine if > > > > they actually are a valid fix. Until that work is complete, remove this > > > > change to ensure that no problems are being introduced into the > > > > codebase. > > > > > > > > Cc: Wenwen Wang > > > > Cc: Richard Guy Briggs > > > > Cc: Paul Moore > > > > Signed-off-by: Greg Kroah-Hartman > > > > --- > > > > kernel/auditfilter.c | 12 +++++------- > > > > 1 file changed, 5 insertions(+), 7 deletions(-) > > > > > > NACK on this revert. I've looked at the original patch again this > > > morning, and the original patch still looks correct and doesn't appear > > > to introduce any new faults to the best of my understanding. > > > > Agreed. Though on review, a much simpler fix to my original patch that > > caused this problem requiring this fix > > e85322d21cfebeac64f58a204e9adc0bc5c1e46f rgb 2014-10-02 ("audit: cull redundancy in audit_rule_change") > > would have been the two-liner in the error path similar to the pattern > > in audit_data_to_entry() error path would have been: > > > > if (entry->rule.tree) > > audit_put_tree(entry->rule.tree); /* that's the temporary one */ > > Given the situation this morning I think it is best to limit > discussion on this thread to just the safety of the patches in > question and the necessity of the reverts Greg is proposing here. If > you have suggestions about how to clean-up or otherwise improve the > code relating to these patches I think it is better to have that > discussion in the appropriate subsystem list/forum/etc (as one would > do normally). My original patch wasn't exploitable anyways since both cases that call audit_rule_change() from audit_receive_msg() were covered, there was no fallthrough, and for extra precaution there was a BUG_ON() added. I'd say it was harmless, essentially a revert of my redundancy cull patch. This seems to be the consensus about many of the patches in this set. Wenwen's address bounces, almost certainly because they moved to cs.uga.edu in between April and July 2019. > paul moore - RGB -- Richard Guy Briggs Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit