On Thu, Jun 9, 2022 at 7:15 PM Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote: > > Replace the single skb pointer in an audit_buffer with > a list of skb pointers. Add the audit_stamp information > to the audit_buffer as there's no guarantee that there > will be an audit_context containing the stamp associated > with the event. At audit_log_end() time create auxiliary > records (none are currently defined) as have been added > to the list. Functions are created to manage the skb list > in the audit_buffer. > > Suggested-by: Paul Moore <paul@xxxxxxxxxxxxxx> > Signed-off-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx> > --- > kernel/audit.c | 113 +++++++++++++++++++++++++++++++++++++++---------- > 1 file changed, 90 insertions(+), 23 deletions(-) ... > diff --git a/kernel/audit.c b/kernel/audit.c > index 6b6c089512f7..987740374dfa 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -1784,8 +1789,12 @@ static struct audit_buffer *audit_buffer_alloc(struct audit_context *ctx, > ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask); > if (!ab->skb) > goto err; > + > + skb_queue_head_init(&ab->skb_list); > + skb_queue_tail(&ab->skb_list, ab->skb); > + > if (!nlmsg_put(ab->skb, 0, 0, type, 0, 0)) > - goto err; > + kfree_skb(ab->skb); > > ab->ctx = ctx; > ab->gfp_mask = gfp_mask; I didn't notice this in v35, but if the nlmsg_put() fails I think you need to preserve the 'goto err;' since the skb hasn't been properly initialized. The good news is that I don't think you need to worry about the 'kfree_skb(ab->skb);' in the error handler as it's already been placed on the audit_buffer:skb_list list and will be freed when audit_buffer_alloc()'s error handling code calls audit_buffer_free(). -- paul-moore.com
