From mboxrd@z Thu Jan 1 00:00:00 1970 From: Gao feng Subject: [PATCH 2/2] audit: fix incorrect set of audit_sock Date: Tue, 17 Dec 2013 11:10:42 +0800 Message-ID: <1387249842-27793-2-git-send-email-gaofeng@cn.fujitsu.com> References: <1387249842-27793-1-git-send-email-gaofeng@cn.fujitsu.com> Return-path: In-Reply-To: <1387249842-27793-1-git-send-email-gaofeng@cn.fujitsu.com> Sender: linux-kernel-owner@vger.kernel.org To: linux-audit@redhat.com Cc: linux-kernel@vger.kernel.org, rgb@redhat.com, eparis@redhat.com, Gao feng List-Id: linux-audit@redhat.com NETLINK_CB(skb).sk is the socket of user space process, netlink_unicast in kauditd_send_skb wants the kernel side socket. Since the sk_state of audit netlink socket is not NETLINK_CONNECTED, so the netlink_getsockbyportid doesn't return -ECONNREFUSED. And the socket of userspace process can be released anytime, so the audit_sock may point to invalid socket. this patch sets the audit_sock to the kernel side audit netlink socket. Signed-off-by: Gao feng --- kernel/audit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/audit.c b/kernel/audit.c index 041b951..ff1d1d7 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -822,7 +822,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) audit_log_config_change("audit_pid", new_pid, audit_pid, 1); audit_pid = new_pid; audit_nlk_portid = NETLINK_CB(skb).portid; - audit_sock = NETLINK_CB(skb).sk; + audit_sock = skb->sk; } if (s.mask & AUDIT_STATUS_RATE_LIMIT) { err = audit_set_rate_limit(s.rate_limit); -- 1.8.3.1