From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeff Layton Subject: Re: [PATCH] audit: grab a reference to context->pwd when it's cached Date: Fri, 5 Oct 2012 07:02:23 -0400 Message-ID: <20121005070223.22e7f95a@tlielax.poochiereds.net> References: <1345079613-27388-1-git-send-email-pmoody@google.com> <20120816012642.GA10020@shell.devel.redhat.com> <20120926135020.GB31705@shell.devel.redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Peter Moody Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thu, 4 Oct 2012 11:48:23 -0700 Peter Moody wrote: > On Wed, Sep 26, 2012 at 6:50 AM, Alexander Viro wrote: > > On Tue, Sep 25, 2012 at 10:03:23AM -0700, Peter Moody wrote: > >> Hey folks, > >> > >> following up on old patches, are there any comments on this? Did you > >> get around to finding a better way to fix this bug, Al? > > > > Alas, I've found none ;-/ Looks like we'll have to go with this one, > > at least until somebody comes up with better solution. > > Not surprisingly, this patch doesn't actually fix the issue (or at > least doesn't do it correctly). > > I hadn't noticed that get_fs_pwd() actually calls path_get() on > &context->pwd so the additional path_get() is useless and the > reference doesn't ever actually get freed if audit_putname is called > while we're in a syscall. > > Al, Eric, Jeff; do any of you guys have an understanding of what the > initial bug actually is since this clearly doesn't fix it? > > Cheers, > peter > Hrm...so yeah. The chdir call should have pinned the dentry. I think you'll need to track down where the oops actually occurred. One way to determine that is to do something like this, but you'll need to replace the kmod in the instructions with your vmlinux: https://wiki.samba.org/index.php/LinuxCIFS_troubleshooting#Oopses -- Jeff Layton