From: Richard Guy Briggs <rgb@redhat.com>
Date: Sat, 27 Jun 2020 23:24:19 -0400
Subject: audit: add gfp parameter to audit_log_nfcfg
Patch-mainline: v5.9-rc1
Git-commit: 142240398e50e5fe3171bcf2459856603be13a39
References: bsc#1176447
Fixed an inconsistent use of GFP flags in nft_obj_notify() that used
GFP_KERNEL when a GFP flag was passed in to that function. Given this
allocated memory was then used in audit_log_nfcfg() it led to an audit
of all other GFP allocations in net/netfilter/nf_tables_api.c and a
modification of audit_log_nfcfg() to accept a GFP parameter.
Reported-by: Dan Carptenter <dan.carpenter@oracle.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
include/linux/audit.h | 8 ++++----
kernel/auditsc.c | 4 ++--
net/bridge/netfilter/ebtables.c | 6 +++---
net/netfilter/nf_tables_api.c | 33 +++++++++++++++++++++------------
net/netfilter/x_tables.c | 5 +++--
5 files changed, 33 insertions(+), 23 deletions(-)
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -410,7 +410,7 @@ extern void __audit_fanotify(unsigned in
extern void __audit_tk_injoffset(struct timespec64 offset);
extern void __audit_ntp_log(const struct audit_ntp_data *ad);
extern void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
- enum audit_nfcfgop op);
+ enum audit_nfcfgop op, gfp_t gfp);
static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
{
@@ -548,10 +548,10 @@ static inline void audit_ntp_log(const s
static inline void audit_log_nfcfg(const char *name, u8 af,
unsigned int nentries,
- enum audit_nfcfgop op)
+ enum audit_nfcfgop op, gfp_t gfp)
{
if (audit_enabled)
- __audit_log_nfcfg(name, af, nentries, op);
+ __audit_log_nfcfg(name, af, nentries, op, gfp);
}
extern int audit_n_rules;
@@ -689,7 +689,7 @@ static inline void audit_ptrace(struct t
static inline void audit_log_nfcfg(const char *name, u8 af,
unsigned int nentries,
- enum audit_nfcfgop op)
+ enum audit_nfcfgop op, gfp_t gfp)
{ }
#define audit_n_rules 0
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2575,12 +2575,12 @@ void __audit_ntp_log(const struct audit_
}
void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
- enum audit_nfcfgop op)
+ enum audit_nfcfgop op, gfp_t gfp)
{
struct audit_buffer *ab;
char comm[sizeof(current->comm)];
- ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_NETFILTER_CFG);
+ ab = audit_log_start(audit_context(), gfp, AUDIT_NETFILTER_CFG);
if (!ab)
return;
audit_log_format(ab, "table=%s family=%u entries=%u op=%s",
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1047,7 +1047,7 @@ static int do_replace_finish(struct net
vfree(counterstmp);
audit_log_nfcfg(repl->name, AF_BRIDGE, repl->nentries,
- AUDIT_XT_OP_REPLACE);
+ AUDIT_XT_OP_REPLACE, GFP_KERNEL);
return ret;
free_unlock:
@@ -1125,7 +1125,7 @@ static void __ebt_unregister_table(struc
list_del(&table->list);
mutex_unlock(&ebt_mutex);
audit_log_nfcfg(table->name, AF_BRIDGE, table->private->nentries,
- AUDIT_XT_OP_UNREGISTER);
+ AUDIT_XT_OP_UNREGISTER, GFP_KERNEL);
EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
ebt_cleanup_entry, net, NULL);
if (table->private->nentries)
@@ -1220,7 +1220,7 @@ int ebt_register_table(struct net *net,
}
audit_log_nfcfg(repl->name, AF_BRIDGE, repl->nentries,
- AUDIT_XT_OP_REGISTER);
+ AUDIT_XT_OP_REGISTER, GFP_KERNEL);
return ret;
free_unlock:
mutex_unlock(&ebt_mutex);
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -690,7 +690,8 @@ static void nf_tables_table_notify(const
ctx->table->use,
event == NFT_MSG_NEWTABLE ?
AUDIT_NFT_OP_TABLE_REGISTER :
- AUDIT_NFT_OP_TABLE_UNREGISTER);
+ AUDIT_NFT_OP_TABLE_UNREGISTER,
+ GFP_KERNEL);
kfree(buf);
if (!ctx->report &&
@@ -1435,7 +1436,8 @@ static void nf_tables_chain_notify(const
ctx->chain->use,
event == NFT_MSG_NEWCHAIN ?
AUDIT_NFT_OP_CHAIN_REGISTER :
- AUDIT_NFT_OP_CHAIN_UNREGISTER);
+ AUDIT_NFT_OP_CHAIN_UNREGISTER,
+ GFP_KERNEL);
kfree(buf);
if (!ctx->report &&
@@ -2711,7 +2713,8 @@ static void nf_tables_rule_notify(const
rule->handle,
event == NFT_MSG_NEWRULE ?
AUDIT_NFT_OP_RULE_REGISTER :
- AUDIT_NFT_OP_RULE_UNREGISTER);
+ AUDIT_NFT_OP_RULE_UNREGISTER,
+ GFP_KERNEL);
kfree(buf);
if (!ctx->report &&
@@ -3724,7 +3727,8 @@ static void nf_tables_set_notify(const s
set->field_count,
event == NFT_MSG_NEWSET ?
AUDIT_NFT_OP_SET_REGISTER :
- AUDIT_NFT_OP_SET_UNREGISTER);
+ AUDIT_NFT_OP_SET_UNREGISTER,
+ gfp_flags);
kfree(buf);
if (!ctx->report &&
@@ -4851,7 +4855,8 @@ static void nf_tables_setelem_notify(con
set->handle,
event == NFT_MSG_NEWSETELEM ?
AUDIT_NFT_OP_SETELEM_REGISTER :
- AUDIT_NFT_OP_SETELEM_UNREGISTER);
+ AUDIT_NFT_OP_SETELEM_UNREGISTER,
+ GFP_KERNEL);
kfree(buf);
if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
@@ -5943,7 +5948,8 @@ static int nf_tables_dump_obj(struct sk_
audit_log_nfcfg(buf,
family,
obj->handle,
- AUDIT_NFT_OP_OBJ_RESET);
+ AUDIT_NFT_OP_OBJ_RESET,
+ GFP_KERNEL);
kfree(buf);
}
@@ -6058,13 +6064,14 @@ static int nf_tables_getobj(struct net *
reset = true;
if (reset) {
- char *buf = kasprintf(GFP_KERNEL, "%s:%llu;?:0",
+ char *buf = kasprintf(GFP_ATOMIC, "%s:%llu;?:0",
table->name, table->handle);
audit_log_nfcfg(buf,
family,
obj->handle,
- AUDIT_NFT_OP_OBJ_RESET);
+ AUDIT_NFT_OP_OBJ_RESET,
+ GFP_KERNEL);
kfree(buf);
}
@@ -6143,7 +6150,7 @@ void nft_obj_notify(struct net *net, con
{
struct sk_buff *skb;
int err;
- char *buf = kasprintf(GFP_KERNEL, "%s:%llu;?:0",
+ char *buf = kasprintf(gfp, "%s:%llu;?:0",
table->name, table->handle);
audit_log_nfcfg(buf,
@@ -6151,7 +6158,8 @@ void nft_obj_notify(struct net *net, con
obj->handle,
event == NFT_MSG_NEWOBJ ?
AUDIT_NFT_OP_OBJ_REGISTER :
- AUDIT_NFT_OP_OBJ_UNREGISTER);
+ AUDIT_NFT_OP_OBJ_UNREGISTER,
+ GFP_KERNEL);
kfree(buf);
if (!report &&
@@ -6958,7 +6966,8 @@ static void nf_tables_flowtable_notify(s
flowtable->hooknum,
event == NFT_MSG_NEWFLOWTABLE ?
AUDIT_NFT_OP_FLOWTABLE_REGISTER :
- AUDIT_NFT_OP_FLOWTABLE_UNREGISTER);
+ AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
+ GFP_KERNEL);
kfree(buf);
if (ctx->report &&
@@ -7082,7 +7091,7 @@ static void nf_tables_gen_notify(struct
int err;
audit_log_nfcfg("?:0;?:0", 0, net->nft.base_seq,
- AUDIT_NFT_OP_GEN_REGISTER);
+ AUDIT_NFT_OP_GEN_REGISTER, GFP_KERNEL);
if (nlmsg_report(nlh) &&
!nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1410,7 +1410,8 @@ xt_replace_table(struct xt_table *table,
audit_log_nfcfg(table->name, table->af, private->number,
!private->number ? AUDIT_XT_OP_REGISTER :
- AUDIT_XT_OP_REPLACE);
+ AUDIT_XT_OP_REPLACE,
+ GFP_KERNEL);
return private;
}
EXPORT_SYMBOL_GPL(xt_replace_table);
@@ -1473,7 +1474,7 @@ void *xt_unregister_table(struct xt_tabl
list_del(&table->list);
mutex_unlock(&xt[table->af].mutex);
audit_log_nfcfg(table->name, table->af, private->number,
- AUDIT_XT_OP_UNREGISTER);
+ AUDIT_XT_OP_UNREGISTER, GFP_KERNEL);
kfree(table);
return private;