提交 040b3a2d 编写于 作者: P Peter Zijlstra 提交者: Linus Torvalds

audit: fix two bugs in the new execve audit code

copy_from_user() returns the number of bytes not copied, hence 0 is the
expected output.

axi->mm might not be valid anymore when not equal to current->mm, do not
dereference before checking that - thanks to Al for spotting that.
Signed-off-by: NPeter Zijlstra <a.p.zijlstra@chello.nl>
Tested-by: NSteve Grubb <sgrubb@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 0af3678f
......@@ -824,12 +824,14 @@ static void audit_log_execve_info(struct audit_buffer *ab,
{
int i;
long len, ret;
const char __user *p = (const char __user *)axi->mm->arg_start;
const char __user *p;
char *buf;
if (axi->mm != current->mm)
return; /* execve failed, no additional info */
p = (const char __user *)axi->mm->arg_start;
for (i = 0; i < axi->argc; i++, p += len) {
len = strnlen_user(p, MAX_ARG_STRLEN);
/*
......@@ -855,7 +857,7 @@ static void audit_log_execve_info(struct audit_buffer *ab,
* copied them here, and the mm hasn't been exposed to user-
* space yet.
*/
if (!ret) {
if (ret) {
WARN_ON(1);
send_sig(SIGKILL, current, 0);
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册