Skip to content

NAS-143100 / 26.0.0-RC.1 / audit: do not follow a stale filename->aname back-pointer (by ixhamza) #352

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
creatorcary merged 1 commit into from
Sep 4, 2026
Merged

NAS-143100 / 26.0.0-RC.1 / audit: do not follow a stale filename->aname back-pointer (by ixhamza) #352

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 21 additions & 3 deletions kernel/auditsc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2259,6 +2259,24 @@ static void audit_copy_inode(struct audit_names *name,
audit_copy_fcaps(name, dentry);
}

/*
* Find the audit_names record this context holds for @name. io_uring can make
* a filename outlive the context its record was created in, so the record is
* looked up by identity among the records this context actually owns rather
* than followed through the filename's ->aname back-pointer, which nothing
* invalidates.
*/
static struct audit_names *audit_name_lookup(struct audit_context *ctx,
const struct filename *name)
{
struct audit_names *n;

list_for_each_entry_reverse(n, &ctx->names_list, list)
if (n->name == name)
return n;
return NULL;
}

/**
* __audit_inode - store the inode and device from a lookup
* @name: name being audited
Expand Down Expand Up @@ -2299,10 +2317,10 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
goto out_alloc;

/*
* If we have a pointer to an audit_names entry already, then we can
* just use it directly if the type is correct.
* If this context already holds a record for this filename, use it
* directly, provided the type is right.
*/
n = name->aname;
n = audit_name_lookup(context, name);
if (n) {
if (parent) {
if (n->type == AUDIT_TYPE_PARENT ||
Expand Down
Loading