From mboxrd@z Thu Jan  1 00:00:00 1970
From: Amy Griffis <amy.griffis@hp.com>
Subject: [PATCH git] fix null dereference in fs audit patch
Date: Tue, 30 May 2006 10:35:22 -0400
Message-ID: <20060530143522.GA25312@zk3.dec.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Return-path: <linux-audit-bounces@redhat.com>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

Check watch pointer before dereferencing.

Al, please fold in with latest filesystem auditing patch
1d9d3267853cc4368c923f1ab7037db8c8805b73.

Signed-off-by: Amy Griffis <amy.griffis@hp.com>

diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 7f2fcd6..f993842 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -1032,12 +1032,13 @@ static inline int audit_do_del_rule(stru
 
 	list_for_each_entry(e, list, list) {
 		struct audit_watch *watch = e->rule.watch;
-		struct audit_parent *parent = watch->parent;
 
 		if (audit_compare_rule(&entry->rule, &e->rule))
 			continue;
 
 		if (watch) {
+			struct audit_parent *parent = watch->parent;
+
 			list_del(&e->rule.rlist);
 
 			if (list_empty(&watch->rules)) {
-- 
1.3.0