Re: [RFC PATCH v3] audit: use proper refcount locking on audit_sock

On 2016-12-13 16:19, Cong Wang wrote:

On Tue, Dec 13, 2016 at 7:03 AM, Richard Guy Briggs [off-list ref] wrote:

quoted

@@ -1283,8 +1299,10 @@ static void __net_exit audit_net_exit(struct net *net)
 {
        struct audit_net *aunet = net_generic(net, audit_net_id);
        struct sock *sock = aunet->nlsk;
+       mutex_lock(&audit_cmd_mutex);
        if (sock == audit_sock)
                auditd_reset();
+       mutex_unlock(&audit_cmd_mutex);

This still doesn't look correct to me, b/c here we release the audit_sock
refcnt twice:

1) inside audit_reset()

The audit_reset() refcount decrement corresponds to a setting of
audit_sock only if audit_sock is still non-NULL.

2) netlink_kernel_release()

This refcount decrement corresponds to netlink_kernel_create().

- RGB

--
Richard Guy Briggs [off-list ref]
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635