{"push_id":1448011487,"size":1,"distinct_size":1,"ref":"refs/heads/cm-14.1","head":"9557e83306d816a38081126a3ec3ed87245b0367","before":"f7e4c2f089e1150a7be859b1f1698c372594b75a","commits":[{"sha":"9557e83306d816a38081126a3ec3ed87245b0367","author":{"name":"Paul Moore","email":"54f65660711c038b3360dd7288dc12347ae58ba3@paul-moore.com"},"message":"audit: fix a double fetch in audit_log_single_execve_arg()\n\nThere is a double fetch problem in audit_log_single_execve_arg()\nwhere we first check the execve(2) argumnets for any \"bad\" characters\nwhich would require hex encoding and then re-fetch the arguments for\nlogging in the audit record[1].  Of course this leaves a window of\nopportunity for an unsavory application to munge with the data.\n\nThis patch reworks things by only fetching the argument data once[2]\ninto a buffer where it is scanned and logged into the audit\nrecords(s).  In addition to fixing the double fetch, this patch\nimproves on the original code in a few other ways: better handling\nof large arguments which require encoding, stricter record length\nchecking, and some performance improvements (completely unverified,\nbut we got rid of some strlen() calls, that's got to be a good\nthing).\n\nAs part of the development of this patch, I've also created a basic\nregression test for the audit-testsuite, the test can be tracked on\nGitHub at the following link:\n\n * https://github.com/linux-audit/audit-testsuite/issues/25\n\n[1] If you pay careful attention, there is actually a triple fetch\nproblem due to a strnlen_user() call at the top of the function.\n\n[2] This is a tiny white lie, we do make a call to strnlen_user()\nprior to fetching the argument data.  I don't like it, but due to the\nway the audit record is structured we really have no choice unless we\ncopy the entire argument at once (which would require a rather\nwasteful allocation).  The good news is that with this patch the\nkernel no longer relies on this strnlen_user() value for anything\nbeyond recording it in the log, we also update it with a trustworthy\nvalue whenever possible.\n\nChange-Id: I2c9e01d1f564d06c06037487fe8a90bcdb036708\nReported-by: Pengfei Wang <wpengfeinudt@gmail.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Paul Moore <paul@paul-moore.com>\nBug: 30956807\n(cherry picked from commit db0a8791c3e1573734030760bedf1be0c40259bb)","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_manta/commits/9557e83306d816a38081126a3ec3ed87245b0367"}]}
{"actor":{"display_login":"cm-gerrit"}}