Re: [PATCH] audit: fix incomplete NETFILTER_PKT records and return void

[sashiko-bot@kernel.org]

> Commit f19590b07cb6 ("audit: add audit_log_nf_skb helper function") and
> commit 15b0c43aa621 ("audit: include source and destination ports to
> NETFILTER_PKT") introduced audit_log_nf_skb() and its transport header
> parsing.
> 
> The helper returned early with -ENOMEM when skb_header_pointer() failed for
> the network header, and the later port parsing did the same for the
> transport header.  Such an early return skips the remaining fields, so the
> NETFILTER_PKT record is emitted with only "mark=" and without the address
> and protocol fields.
> 
> Log the address and protocol once the network header is available, and
> route the error paths through placeholder logging: a missing network header
> logs "saddr=? daddr=? proto=-1", as the pre-refactoring callers did, and a
> transport header that cannot be read where one is expected logs
> [ ... ]
>   after:  mark=0x0 saddr=10.20.0.2 daddr=10.20.0.1 proto=6 sport=? dport=?
> 
> Fixes: f19590b07cb6 ("audit: add audit_log_nf_skb helper function")
> Fixes: 15b0c43aa621 ("audit: include source and destination ports to NETFILTER_PKT")
> Signed-off-by: JiangJieHua <jiangjiehua1@huawei.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110122939.45373-1-jiangjiehua1@huawei.com?part=1