NETLINK_CB(skb).sk is the socket of user space process, netlink_unicast in kauditd_send_skb wants the kernel side socket. Since the sk_state of audit netlink socket is not NETLINK_CONNECTED, so the netlink_getsockbyportid doesn't return -ECONNREFUSED. And the socket of userspace process can be released anytime, so the audit_sock may point to invalid socket. this patch sets the audit_sock to the kernel side audit netlink socket. Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com&gt;

--- kernel/audit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/audit.c b/kernel/audit.c index 041b951..ff1d1d7 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -822,7 +822,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) audit_log_config_change("audit_pid", new_pid, audit_pid, 1); audit_pid = new_pid; audit_nlk_portid = NETLINK_CB(skb).portid; - audit_sock = NETLINK_CB(skb).sk; + audit_sock = skb->sk; } if (s.mask & AUDIT_STATUS_RATE_LIMIT) { err = audit_set_rate_limit(s.rate_limit);

print the error message and then return -ENOMEM. Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com&gt;

--- kernel/audit.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index 2a0ed0b..041b951 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1083,12 +1083,11 @@ static int __net_init audit_net_init(struct net *net) pr_info("audit: initializing netlink socket in namespace\n"); aunet->nlsk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg); - if (aunet->nlsk == NULL) - return -ENOMEM; - if (!aunet->nlsk) + if (aunet->nlsk == NULL) { audit_panic("cannot initialize netlink socket in namespace"); - else - aunet->nlsk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; + return -ENOMEM; + } + aunet->nlsk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; return 0; }

print the error message and then return -ENOMEM. ... --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1083,12 +1083,11 @@ static int __net_init audit_net_init(struct net *net) pr_info("audit: initializing netlink socket in namespace\n"); aunet->nlsk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg); - if (aunet->nlsk == NULL) - return -ENOMEM; - if (!aunet->nlsk) + if (aunet->nlsk == NULL) { audit_panic("cannot initialize netlink socket in namespace"); - else - aunet->nlsk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; + return -ENOMEM; + } + aunet->nlsk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; return 0; }

On 01/08/2014 08:53 AM, Andrew Morton wrote: > On Tue, 17 Dec 2013 11:10:41 +0800 Gao feng <gaofeng(a)cn.fujitsu.com&gt; wrote: > >> print the error message and then return -ENOMEM. >> >> ... >> >> --- a/kernel/audit.c >> +++ b/kernel/audit.c >> @@ -1083,12 +1083,11 @@ static int __net_init audit_net_init(struct net *net) >> pr_info("audit: initializing netlink socket in namespace\n"); >> >> aunet->nlsk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg); >> - if (aunet->nlsk == NULL) >> - return -ENOMEM; >> - if (!aunet->nlsk) >> + if (aunet->nlsk == NULL) { >> audit_panic("cannot initialize netlink socket in namespace"); >> - else >> - aunet->nlsk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; >> + return -ENOMEM; >> + } >> + aunet->nlsk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; >> return 0; >> } > > What kernel version are these against? Something ancient, I expect - > audit_net_init() doesn't exist. > > Please check current kernels, redo and resend the patches if anything > needs changing? This patch is against Richard Guy Briggs's audit tree. the current kernel doesn't have this problem. BTW, Richard & Eric, when do you plan to push these changes to the upstream? there are a lot of changes in Richard's tree.