Re: [PATCH] audit: get comm using lock to avoid race in string printing

On 03/15/2014 07:29 PM, Richard Guy Briggs wrote: > --- > kernel/audit.c | 5 ++--- > kernel/auditsc.c | 9 +++++---- > 2 files changed, 7 insertions(+), 7 deletions(-) Doesn't this also need to be fixed (twice) in security/lsm_audit.c?

> diff --git a/kernel/audit.c b/kernel/audit.c > index 9239e5e..5b600c8 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -1883,7 +1883,7 @@ EXPORT_SYMBOL(audit_log_task_context); > void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk) > { > const struct cred *cred; > - char name[sizeof(tsk->comm)]; > + char comm[sizeof(tsk->comm)]; > struct mm_struct *mm = tsk->mm; > char *tty; > > @@ -1917,9 +1917,8 @@ void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk) > from_kgid(&init_user_ns, cred->fsgid), > tty, audit_get_sessionid(tsk)); > > - get_task_comm(name, tsk); > audit_log_format(ab, " comm="); > - audit_log_untrustedstring(ab, name); > + audit_log_untrustedstring(ab, get_task_comm(name, tsk)); > > if (mm) { > down_read(&mm->mmap_sem); > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > index 8fffca8..b789e0c 100644 > --- a/kernel/auditsc.c > +++ b/kernel/auditsc.c > @@ -2289,7 +2289,7 @@ void __audit_ptrace(struct task_struct *t) > context->target_uid = task_uid(t); > context->target_sessionid = audit_get_sessionid(t); > security_task_getsecid(t, &context->target_sid); > - memcpy(context->target_comm, t->comm, TASK_COMM_LEN); > + get_task_comm(context->target_comm, t); > } > > /** > @@ -2328,7 +2328,7 @@ int __audit_signal_info(int sig, struct task_struct *t) > ctx->target_uid = t_uid; > ctx->target_sessionid = audit_get_sessionid(t); > security_task_getsecid(t, &ctx->target_sid); > - memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN); > + get_task_comm(ctx->target_comm, t); > return 0; > } > > @@ -2349,7 +2349,7 @@ int __audit_signal_info(int sig, struct task_struct *t) > axp->target_uid[axp->pid_count] = t_uid; > axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t); > security_task_getsecid(t, &axp->target_sid[axp->pid_count]); > - memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN); > + get_task_comm(axp->target_comm[axp->pid_count], t); > axp->pid_count++; > > return 0; > @@ -2435,6 +2435,7 @@ static void audit_log_task(struct audit_buffer *ab) > kgid_t gid; > unsigned int sessionid; > struct mm_struct *mm = current->mm; > + char comm[sizeof(current->comm)]; > > auid = audit_get_loginuid(current); > sessionid = audit_get_sessionid(current); > @@ -2447,7 +2448,7 @@ static void audit_log_task(struct audit_buffer *ab) > sessionid); > audit_log_task_context(ab); > audit_log_format(ab, " pid=%d comm=", task_pid_nr(current)); > - audit_log_untrustedstring(ab, current->comm); > + audit_log_untrustedstring(ab, get_task_comm(comm, current); > if (mm) { > down_read(&mm->mmap_sem); > if (mm->exe_file) >