{"push_id":2977475476,"size":1,"distinct_size":1,"ref":"refs/heads/master","head":"f76257c6f932d74c212dd857cc4cd1444f397af8","before":"d36c2f5e349da16c03a383b08d28c8b273cbce61","commits":[{"sha":"f76257c6f932d74c212dd857cc4cd1444f397af8","author":{"name":"Ronny Chevalier","email":"da6a862b8f7aabf9f6edc1e05c6b0d772eba82c1@hp.com"},"message":"audit: fix use-after-free in audit_add_watch\n\n[ Upstream commit baa2a4fdd525c8c4b0f704d20457195b29437839 ]\n\naudit_add_watch stores locally krule->watch without taking a reference\non watch. Then, it calls audit_add_to_parent, and uses the watch stored\nlocally.\n\nUnfortunately, it is possible that audit_add_to_parent updates\nkrule->watch.\nWhen it happens, it also drops a reference of watch which\ncould free the watch.\n\nHow to reproduce (with KASAN enabled):\n\n    auditctl -w /etc/passwd -F success=0 -k test_passwd\n    auditctl -w /etc/passwd -F success=1 -k test_passwd2\n\nThe second call to auditctl triggers the use-after-free, because\naudit_to_parent updates krule->watch to use a previous existing watch\nand drops the reference to the newly created watch.\n\nTo fix the issue, we grab a reference of watch and we release it at the\nend of the function.\n\nSigned-off-by: Ronny Chevalier <ronny.chevalier@hp.com>\nReviewed-by: Richard Guy Briggs <rgb@redhat.com>\nSigned-off-by: Paul Moore <paul@paul-moore.com>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n(cherry picked from commit 2e866a2750fb683bd6d6b9422856b4f10be6659b)","distinct":true,"url":"https://api.github.com/repos/TheHitMan7/android_kernel_msm8953_mido/commits/f76257c6f932d74c212dd857cc4cd1444f397af8"}]}
{"actor":{"display_login":"TheHitMan7"}}