audit: Fix use after free in audit_remove_watch_rule()
audit_remove_watch_rule() drops watch's reference to parent but then continues to work with it. That is not safe as parent can get freed once we drop our reference. The following is a trivial reproducer: mount -o loop image /mnt touch /mnt/file auditctl -w /mnt/file -p wax umount /mnt auditctl -D <crash in fsnotify_destroy_mark()> Grab our own reference in audit_remove_watch_rule() earlier to make sure mark does not get freed under us. CC: stable@vger.kernel.org Reported-by: NTony Jones <tonyj@suse.de> Signed-off-by: NJan Kara <jack@suse.cz> Tested-by: NTony Jones <tonyj@suse.de> Signed-off-by: NPaul Moore <paul@paul-moore.com>
Showing
想要评论请 注册 或 登录