• Richard Guy Briggs's avatar
    audit: move put_tree() to avoid trim_trees refcount underflow and UAF · 2424b0eb
    Richard Guy Briggs authored
    commit 67d69e9d upstream.
    AUDIT_TRIM is expected to be idempotent, but multiple executions resulted
    in a refcount underflow and use-after-free.
    git bisect fingered commit fb041bb7	("locking/refcount: Consolidate
    implementations of refcount_t") but this patch with its more thorough
    checking that wasn't in the x86 assembly code merely exposed a previously
    existing tree refcount imbalance in the case of tree trimming code that
    was refactored with prune_one() to remove a tree introduced in
    commit 8432c700 ("audit: Simplify locking around untag_chunk()")
    Move the put_tree() to cover only the prune_one() case.
    Passes audit-testsuite and 3 passes of "auditctl -t" with at least one
    directory watch.
    Cc: Jan Kara <jack@suse.cz>
    Cc: Will Deacon <will@kernel.org>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Cc: Seiji Nishikawa <snishika@redhat.com>
    Cc: stable@vger.kernel.org
    Fixes: 8432c700
     ("audit: Simplify locking around untag_chunk()")
    Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
    Reviewed-by: default avatarJan Kara <jack@suse.cz>
    [PM: reformatted/cleaned-up the commit description]
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>