On Wed, 27 Oct 2004 13:26:35 EDT, Stephen Smalley said:
> SELinux was migrated from using printk to using the kernel audit
> framework developed by RedHat a while back. We started getting bug
> reports about truncated audit messages not long after...
There's this code in kernel/audit.c, in audit_log_drain():
if (!audit_pid) { /* No daemon */
int offset = ab->nlh ? NLMSG_SPACE(0) : 0;
int len = skb->len - offset;
printk(KERN_ERR "%*.*s\n",
len, len, skb->data + offset);
}
That len/offset look racy to me. It's called from audit_log_end_fast(),
which checks for calls in IRQ context, but I'm not seeing where we do any SMP
or PREEMPT locking.
Attachment:
pgpmNeUiC5gxu.pgp
Description: PGP signature
