Messages in this thread Patch in this message | | | From | Jia-Ju Bai <> | Subject | [PATCH] kernel: auditfilter: Fix a possible null-pointer dereference in audit_watch_path() | Date | Tue, 23 Jul 2019 20:49:51 +0800 |
| |
In audit_find_rule(), there is an if statement on line 894 to check whether entry->rule.watch is NULL: else if (entry->rule.watch)
If entry->rule.watch is NULL, audit_compare_rule on 910 is called: audit_compare_rule(&entry->rule, &e->rule))
In audit_compare_rule(), a->watch is used on line 720: if (strcmp(audit_watch_path(a->watch), ...)
In this case, a->watch is NULL, and audit_watch_path() will use: watch->path
Thus, a possible null-pointer dereference may occur in this case.
To fix this possible bug, an if statement is added in audit_compare_rule() to check a->watch before using a->watch.
This bug is found by a static analysis tool STCheck written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> --- kernel/auditfilter.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index b0126e9c0743..b0ad17b14609 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -717,6 +717,8 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b) return 1; break; case AUDIT_WATCH: + if (!a->watch) + break; if (strcmp(audit_watch_path(a->watch), audit_watch_path(b->watch))) return 1; -- 2.17.0
| |