[PATCH v2 0/2] audit: fix recursive locking deadlock and dangling rule removal

[Ricardo Robaina <rrobaina@redhat.com>]

This patch series fixes a recursive locking deadlock in audit_dupe_exe()
code path, as well as, a bug that prevents the deletion of dangling
audit rules.

The first patch, simply removes the d_really_is_negative() check in
audit_alloc_mark() to allow dummy mark allocation, fixing the -ENOENT
failure when deleting dangling rules for unlinked executables.

The second one, fixes the deadlock in audit_dupe_exe() by introducing
the audit_watch_ctx struct to pass the fsnotify event context down the
call chain. This safely bypasses the need for kern_path_parent() during
move events, avoiding a double acquisition of the I_MUTEX_PARENT lock.

Acked-by: Waiman Long <longman@redhat.com>
Acked-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>

---
Changes in v2:
- Reordered patches
- Refactored audit_alloc_mark() to eliminate code duplication by introducing
  local dir/child inode variables and unifying the critical execution path
- Added allow_dups variable to preserve original behavior: manual rule
  additions use allow_dups=0 (no duplicates), fsnotify events use
  allow_dups=1 (allow temporary coexistence during rename)

Ricardo Robaina (2):
  audit: fix removal of dangling executable rules
  audit: fix recursive locking deadlock in audit_dupe_exe()

 kernel/audit.h          | 13 ++++++++++---
 kernel/audit_fsnotify.c | 34 ++++++++++++++++++++++------------
 kernel/audit_watch.c    | 25 +++++++++++++++++--------
 kernel/auditfilter.c    |  9 +++++----
 4 files changed, 54 insertions(+), 27 deletions(-)

-- 
2.53.0