From: Davidlohr Bueso <dave(a)stgolabs.net&gt; The mm->exe_file is currently serialized with mmap_sem (shared) in order to both safely (1) read the file and (2) audit it via audit_log_d_path(). Good users will, on the other hand, make use of the more standard get_mm_exe_file(), requiring only holding the mmap_sem to read the value, and relying on reference counting to make sure that the exe file won't dissapear underneath us. This is safe as audit_log_d_path() does not need the mmap_sem -- ...and if it did we seriously need to fix that. Additionally, upon NULL return of get_mm_exe_file, we also call audit_log_format(ab, " exe=(null)"). Cc: Paul Moore <paul(a)paul-moore.com&gt; Cc: Eric Paris <eparis(a)redhat.com&gt; Cc: linux-audit(a)redhat.com Signed-off-by: Davidlohr Bueso <dbueso(a)suse.de&gt; --- Compiled tested only. kernel/audit.h | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/kernel/audit.h b/kernel/audit.h index 510901f..17020f0 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -20,6 +20,7 @@ */ #include <linux/fs.h> +#include <linux/file.h> #include <linux/audit.h> #include <linux/skbuff.h> #include <uapi/linux/mqueue.h> @@ -260,15 +261,20 @@ extern struct audit_entry *audit_dupe_rule(struct audit_krule *old); static inline void audit_log_d_path_exe(struct audit_buffer *ab, struct mm_struct *mm) { - if (!mm) { - audit_log_format(ab, " exe=(null)"); - return; - } - - down_read(&mm->mmap_sem); - if (mm->exe_file) - audit_log_d_path(ab, " exe=", &mm->exe_file->f_path); - up_read(&mm->mmap_sem); + struct file *exe_file; + + if (!mm) + goto out_null; + + exe_file = get_mm_exe_file(mm); + if (!exe_file) + goto out_null; + + audit_log_d_path(ab, " exe=", &exe_file->f_path); + fput(exe_file); + return; +out_null: + audit_log_format(ab, " exe=(null)"); } /* audit watch functions */ -- 2.1.4