* [PATCH v1] audit: fix illegal pointer dereference for openat2
@ 2022-02-09 21:50 Richard Guy Briggs
2022-02-09 23:44 ` Paul Moore
0 siblings, 1 reply; 2+ messages in thread
From: Richard Guy Briggs @ 2022-02-09 21:50 UTC (permalink / raw)
To: Linux-Audit Mailing List, LKML, linux-fsdevel
Cc: Arnd Bergmann, Richard Guy Briggs, Jeff Mahoney, stable,
Aleksa Sarai, Alexander Viro, Eric Paris
The user pointer was being illegally dereferenced directly to get the
open_how flags data in audit_match_perm. Use the previously saved flags
data elsewhere in the context instead.
Coverage is provided by the audit-testsuite syscalls_file test case.
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/c96031b4-b76d-d82c-e232-1cccbbf71946@suse.com
Fixes: 1c30e3af8a79 ("audit: add support for the openat2 syscall")
Reported-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
kernel/auditsc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index fce5d43a933f..81ab510a7be4 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -185,7 +185,7 @@ static int audit_match_perm(struct audit_context *ctx, int mask)
case AUDITSC_EXECVE:
return mask & AUDIT_PERM_EXEC;
case AUDITSC_OPENAT2:
- return mask & ACC_MODE((u32)((struct open_how *)ctx->argv[2])->flags);
+ return mask & ACC_MODE((u32)(ctx->openat2.flags));
default:
return 0;
}
--
2.27.0
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v1] audit: fix illegal pointer dereference for openat2
2022-02-09 21:50 [PATCH v1] audit: fix illegal pointer dereference for openat2 Richard Guy Briggs
@ 2022-02-09 23:44 ` Paul Moore
0 siblings, 0 replies; 2+ messages in thread
From: Paul Moore @ 2022-02-09 23:44 UTC (permalink / raw)
To: Richard Guy Briggs
Cc: Arnd Bergmann, Jeff Mahoney, LKML, stable, Aleksa Sarai,
Linux-Audit Mailing List, Alexander Viro, linux-fsdevel,
Eric Paris
On Wed, Feb 9, 2022 at 4:51 PM Richard Guy Briggs <rgb@redhat.com> wrote:
>
> The user pointer was being illegally dereferenced directly to get the
> open_how flags data in audit_match_perm. Use the previously saved flags
> data elsewhere in the context instead.
>
> Coverage is provided by the audit-testsuite syscalls_file test case.
>
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/r/c96031b4-b76d-d82c-e232-1cccbbf71946@suse.com
> Fixes: 1c30e3af8a79 ("audit: add support for the openat2 syscall")
> Reported-by: Jeff Mahoney <jeffm@suse.com>
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> ---
> kernel/auditsc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Thanks Richard. As this came in ~40m after the other patch, and both
are identical code changes, I've merged the other patch but I did add
a note that you also submitted a similar patch. Once the automated
testing completes I'll send this up to Linus.
--
paul-moore.com
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-02-09 23:45 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-09 21:50 [PATCH v1] audit: fix illegal pointer dereference for openat2 Richard Guy Briggs
2022-02-09 23:44 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).