sanitize audit_mq_open()

* don't bother with allocations
* don't do double copy_from_user()
* don't duplicate parts of check for audit_dummy_context()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 67f0cdd991ba970884bd4a345818714bb8dbe11a..54978bdd2bd4a349b07e636418444686ad399012 100644 (file)
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -450,7 +450,7 @@ extern void audit_socketcall(int nargs, unsigned long *args);
 extern int audit_sockaddr(int len, void *addr);
 extern int __audit_fd_pair(int fd1, int fd2);
 extern int audit_set_macxattr(const char *name);
-extern int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr);
+extern void __audit_mq_open(int oflag, mode_t mode, struct mq_attr *attr);
 extern void __audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout);
 extern void __audit_mq_notify(mqd_t mqdes, const struct sigevent *notification);
 extern void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat);
@@ -475,11 +475,10 @@ static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid
        if (unlikely(!audit_dummy_context()))
                __audit_ipc_set_perm(qbytes, uid, gid, mode);
 }
-static inline int audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr)
+static inline void audit_mq_open(int oflag, mode_t mode, struct mq_attr *attr)
 {
        if (unlikely(!audit_dummy_context()))
-               return __audit_mq_open(oflag, mode, u_attr);
-       return 0;
+               __audit_mq_open(oflag, mode, attr);
 }
 static inline void audit_mq_sendrecv(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec *abs_timeout)
 {
@@ -541,7 +540,7 @@ extern int audit_signals;
 #define audit_fd_pair(n,a) ({ 0; })
 #define audit_sockaddr(len, addr) ({ 0; })
 #define audit_set_macxattr(n) do { ; } while (0)
-#define audit_mq_open(o,m,a) ({ 0; })
+#define audit_mq_open(o,m,a) ((void)0)
 #define audit_mq_sendrecv(d,l,p,t) ((void)0)
 #define audit_mq_notify(d,n) ((void)0)
 #define audit_mq_getsetattr(d,s) ((void)0)

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 192da806c283b10390aa8f912c53f470a9caaa95..d448b69672b53d681802c456a0f66ef2528a4de9 100644 (file)
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -588,22 +588,18 @@ static int mq_attr_ok(struct mq_attr *attr)
  * Invoked when creating a new queue via sys_mq_open
  */
 static struct file *do_create(struct dentry *dir, struct dentry *dentry,
-                       int oflag, mode_t mode, struct mq_attr __user *u_attr)
+                       int oflag, mode_t mode, struct mq_attr *attr)
 {
        const struct cred *cred = current_cred();
-       struct mq_attr attr;
        struct file *result;
        int ret;
 
-       if (u_attr) {
-               ret = -EFAULT;
-               if (copy_from_user(&attr, u_attr, sizeof(attr)))
-                       goto out;
+       if (attr) {
                ret = -EINVAL;
-               if (!mq_attr_ok(&attr))
+               if (!mq_attr_ok(attr))
                        goto out;
                /* store for use during create */
-               dentry->d_fsdata = &attr;
+               dentry->d_fsdata = attr;
        }
 
        mode &= ~current->fs->umask;
@@ -660,11 +656,13 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
        struct dentry *dentry;
        struct file *filp;
        char *name;
+       struct mq_attr attr;
        int fd, error;
 
-       error = audit_mq_open(oflag, mode, u_attr);
-       if (error != 0)
-               return error;
+       if (u_attr && copy_from_user(&attr, u_attr, sizeof(struct mq_attr)))
+               return -EFAULT;
+
+       audit_mq_open(oflag, mode, u_attr ? &attr : NULL);
 
        if (IS_ERR(name = getname(u_name)))
                return PTR_ERR(name);
@@ -690,7 +688,8 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
                        filp = do_open(dentry, oflag);
                } else {
                        filp = do_create(mqueue_mnt->mnt_root, dentry,
-                                               oflag, mode, u_attr);
+                                               oflag, mode,
+                                               u_attr ? &attr : NULL);
                }
        } else {
                error = -ENOENT;

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 140c47453470afc498e54ce88610c15c79390d58..83e946f1cdde7a082f8abebc1a9706c67a0886e1 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -124,13 +124,6 @@ struct audit_aux_data {
 /* Number of target pids per aux struct. */
 #define AUDIT_AUX_PIDS 16
 
-struct audit_aux_data_mq_open {
-       struct audit_aux_data   d;
-       int                     oflag;
-       mode_t                  mode;
-       struct mq_attr          attr;
-};
-
 struct audit_aux_data_execve {
        struct audit_aux_data   d;
        int argc;
@@ -242,6 +235,11 @@ struct audit_context {
                        unsigned int            msg_prio;
                        struct timespec         abs_timeout;
                } mq_sendrecv;
+               struct {
+                       int                     oflag;
+                       mode_t                  mode;
+                       struct mq_attr          attr;
+               } mq_open;
        };
 
 #if AUDIT_DEBUG
@@ -1263,6 +1261,16 @@ static void show_special(struct audit_context *context, int *call_panic)
                                return;
                }
                break; }
+       case AUDIT_MQ_OPEN: {
+               audit_log_format(ab,
+                       "oflag=0x%x mode=%#o mq_flags=0x%lx mq_maxmsg=%ld "
+                       "mq_msgsize=%ld mq_curmsgs=%ld",
+                       context->mq_open.oflag, context->mq_open.mode,
+                       context->mq_open.attr.mq_flags,
+                       context->mq_open.attr.mq_maxmsg,
+                       context->mq_open.attr.mq_msgsize,
+                       context->mq_open.attr.mq_curmsgs);
+               break; }
        case AUDIT_MQ_SENDRECV: {
                audit_log_format(ab,
                        "mqdes=%d msg_len=%zd msg_prio=%u "
@@ -1368,15 +1376,6 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
                        continue; /* audit_panic has been called */
 
                switch (aux->type) {
-               case AUDIT_MQ_OPEN: {
-                       struct audit_aux_data_mq_open *axi = (void *)aux;
-                       audit_log_format(ab,
-                               "oflag=0x%x mode=%#o mq_flags=0x%lx mq_maxmsg=%ld "
-                               "mq_msgsize=%ld mq_curmsgs=%ld",
-                               axi->oflag, axi->mode, axi->attr.mq_flags,
-                               axi->attr.mq_maxmsg, axi->attr.mq_msgsize,
-                               axi->attr.mq_curmsgs);
-                       break; }
 
                case AUDIT_EXECVE: {
                        struct audit_aux_data_execve *axi = (void *)aux;
@@ -2135,38 +2134,20 @@ int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
  * @mode: mode bits
  * @u_attr: queue attributes
  *
- * Returns 0 for success or NULL context or < 0 on error.
  */
-int __audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr)
+void __audit_mq_open(int oflag, mode_t mode, struct mq_attr *attr)
 {
-       struct audit_aux_data_mq_open *ax;
        struct audit_context *context = current->audit_context;
 
-       if (!audit_enabled)
-               return 0;
-
-       if (likely(!context))
-               return 0;
-
-       ax = kmalloc(sizeof(*ax), GFP_ATOMIC);
-       if (!ax)
-               return -ENOMEM;
-
-       if (u_attr != NULL) {
-               if (copy_from_user(&ax->attr, u_attr, sizeof(ax->attr))) {
-                       kfree(ax);
-                       return -EFAULT;
-               }
-       } else
-               memset(&ax->attr, 0, sizeof(ax->attr));
+       if (attr)
+               memcpy(&context->mq_open.attr, attr, sizeof(struct mq_attr));
+       else
+               memset(&context->mq_open.attr, 0, sizeof(struct mq_attr));
 
-       ax->oflag = oflag;
-       ax->mode = mode;
+       context->mq_open.oflag = oflag;
+       context->mq_open.mode = mode;
 
-       ax->d.type = AUDIT_MQ_OPEN;
-       ax->d.next = context->aux;
-       context->aux = (void *)ax;
-       return 0;
+       context->type = AUDIT_MQ_OPEN;
 }
 
 /**